Merge pull request #6741 from swordqiu/automated-cherry-pick-of-#6740-upstream-release-3.2

Automated cherry pick of #6740: fix: xsky recode using endpoint as accesskey key

Makefile

@@ -291,9 +291,11 @@ gen-swagger: gen-swagger-check
 	$(ROOT_DIR)/scripts/codegen.py swagger-code
 	$(ROOT_DIR)/scripts/codegen.py swagger-yaml
 
-swagger-serve: gen-model-api gen-swagger
+swagger-serve-only:
 	$(ROOT_DIR)/scripts/codegen.py swagger-serve
 
+swagger-serve: gen-model-api gen-swagger swagger-serve-only
+
 swagger-site: gen-model-api gen-swagger
 	$(ROOT_DIR)/scripts/codegen.py swagger-site
 

build/notify/root/opt/yunion/share/template/remote/VERIFY.mobile

@@ -1 +0,0 @@
-SMS_126915025

cmd/climc/shell/cloudaccounts.go

@@ -26,6 +26,28 @@ import (
 	"yunion.io/x/onecloud/pkg/mcclient/options"
 )
 
+func parseGcpCredential(filename string) (jsonutils.JSONObject, error) {
+	data, err := ioutil.ReadFile(filename)
+	if err != nil {
+		return nil, err
+	}
+	authParams, err := jsonutils.Parse(data)
+	if err != nil {
+		return nil, err
+	}
+	ret := jsonutils.NewDict()
+	for _, k := range []string{
+		"client_email",
+		"project_id",
+		"private_key_id",
+		"private_key",
+	} {
+		v, _ := authParams.Get(k)
+		ret.Add(v, fmt.Sprintf("gcp_%s", k))
+	}
+	return ret, nil
+}
+
 func init() {
 
 	type CloudaccountListOptions struct {
@@ -33,6 +55,7 @@ func init() {
 		Capability []string `help:"capability filter" choices:"project|compute|network|loadbalancer|objectstore|rds|cache|event"`
 
 		DistinctField string `help:"distinct field"`
+		ProxySetting  string `help:"Proxy setting id or name"`
 	}
 	R(&CloudaccountListOptions{}, "cloud-account-list", "List cloud accounts", func(s *mcclient.ClientSession, args *CloudaccountListOptions) error {
 		var params *jsonutils.JSONDict
@@ -45,6 +68,9 @@ func init() {
 			if len(args.Capability) > 0 {
 				params.Add(jsonutils.NewStringArray(args.Capability), "capability")
 			}
+			if len(args.ProxySetting) > 0 {
+				params.Add(jsonutils.NewString(args.ProxySetting), "proxy_setting")
+			}
 		}
 		if len(args.DistinctField) > 0 {
 			params.Add(jsonutils.NewString(args.DistinctField), "extra_field")
@@ -149,11 +175,7 @@ func init() {
 	R(&options.SGoogleCloudAccountCreateOptions{}, "cloud-account-create-google", "Create a Google cloud account", func(s *mcclient.ClientSession, args *options.SGoogleCloudAccountCreateOptions) error {
 		params := jsonutils.Marshal(args)
 		params.(*jsonutils.JSONDict).Add(jsonutils.NewString("Google"), "provider")
-		data, err := ioutil.ReadFile(args.GoogleJsonFile)
-		if err != nil {
-			return err
-		}
-		authParams, err := jsonutils.Parse(data)
+		authParams, err := parseGcpCredential(args.GoogleJsonFile)
 		if err != nil {
 			return err
 		}
@@ -699,11 +721,7 @@ func init() {
 	})
 
 	R(&options.SGoogleCloudAccountUpdateCredentialOptions{}, "cloud-account-update-credential-google", "Update credential of a Google cloud account", func(s *mcclient.ClientSession, args *options.SGoogleCloudAccountUpdateCredentialOptions) error {
-		data, err := ioutil.ReadFile(args.GoogleJsonFile)
-		if err != nil {
-			return err
-		}
-		params, err := jsonutils.Parse(data)
+		params, err := parseGcpCredential(args.GoogleJsonFile)
 		if err != nil {
 			return err
 		}
@@ -826,11 +844,7 @@ func init() {
 	})
 
 	R(&options.SGoogleCloudAccountUpdateCredentialOptions{}, "cloud-account-test-connectivity-google", "Update credential of a Google cloud account", func(s *mcclient.ClientSession, args *options.SGoogleCloudAccountUpdateCredentialOptions) error {
-		data, err := ioutil.ReadFile(args.GoogleJsonFile)
-		if err != nil {
-			return err
-		}
-		params, err := jsonutils.Parse(data)
+		params, err := parseGcpCredential(args.GoogleJsonFile)
 		if err != nil {
 			return err
 		}
@@ -1027,4 +1041,12 @@ func init() {
 		return nil
 	})
 
+	R(&CloudaccountShowOptions{}, "cloud-account-change-owner-candidate-domains", "Show candiate domains of a cloud account changing project", func(s *mcclient.ClientSession, args *CloudaccountShowOptions) error {
+		result, err := modules.Cloudaccounts.GetSpecific(s, args.ID, "change-owner-candidate-domains", nil)
+		if err != nil {
+			return err
+		}
+		printObject(result)
+		return nil
+	})
 }

cmd/climc/shell/cloudproviders.go

@@ -34,6 +34,7 @@ func init() {
 		HasObjectStorage bool     `help:"filter cloudproviders that has object storage"`
 		NoObjectStorage  bool     `help:"filter cloudproviders that has no object storage"`
 		Capability       []string `help:"capability filter" choices:"project|compute|network|loadbalancer|objectstore|rds|cache|event"`
+		Cloudregion      string   `help:"filter cloudproviders by cloudregion"`
 	}
 	R(&CloudproviderListOptions{}, "cloud-provider-list", "List cloud providers", func(s *mcclient.ClientSession, args *CloudproviderListOptions) error {
 		var params *jsonutils.JSONDict
@@ -57,6 +58,10 @@ func init() {
 			if len(args.Capability) > 0 {
 				params.Add(jsonutils.NewStringArray(args.Capability), "capability")
 			}
+
+			if len(args.Cloudregion) > 0 {
+				params.Add(jsonutils.NewString(args.Cloudregion), "cloudregion")
+			}
 		}
 		result, err := modules.Cloudproviders.List(s, params)
 		if err != nil {
@@ -245,4 +250,13 @@ func init() {
 		printObject(result)
 		return nil
 	})
+
+	R(&CloudproviderShowOptions{}, "cloud-provider-change-owner-candidate-domains", "Show candiate domains of a cloud provider  changing owner", func(s *mcclient.ClientSession, args *CloudproviderShowOptions) error {
+		result, err := modules.Cloudproviders.GetSpecific(s, args.ID, "change-owner-candidate-domains", nil)
+		if err != nil {
+			return err
+		}
+		printObject(result)
+		return nil
+	})
 }

cmd/climc/shell/copyright.go

@@ -15,7 +15,14 @@
 package shell
 
 import (
+	"bufio"
+	"bytes"
+	"encoding/base64"
 	"fmt"
+	"io/ioutil"
+	"mime/multipart"
+	"net/http"
+	"path/filepath"
 
 	"yunion.io/x/jsonutils"
 
@@ -56,4 +63,78 @@ func init() {
 		printObject(r)
 		return nil
 	})
+
+	type EnterpriseUpdateOptions struct {
+		Name      string `help:"Enterprise name"`
+		Copyright string `help:"The Email"`
+		Logo      string `help:"logo file path"`
+		LoginLogo string `help:"login page logo file path"`
+		Favicon   string `help:"favicon path"`
+	}
+
+	R(&EnterpriseUpdateOptions{}, "infos-update", "update enterprise info", func(s *mcclient.ClientSession, args *EnterpriseUpdateOptions) error {
+		var b bytes.Buffer
+		w := multipart.NewWriter(&b)
+		if len(args.Name) > 0 {
+			w.WriteField("name", args.Name)
+		}
+
+		if len(args.Copyright) > 0 {
+			w.WriteField("copyright", args.Copyright)
+		}
+
+		writeFile := func(filedName, filePath string) error {
+			if len(filePath) == 0 {
+				return nil
+			}
+
+			c, err := ioutil.ReadFile(filePath)
+			if err != nil {
+				return err
+			}
+
+			var v string
+			c64 := base64.StdEncoding.EncodeToString(c)
+			ext := filepath.Ext(filePath)
+			switch ext {
+			case ".png":
+				v = fmt.Sprintf("data:image/png;base64,%s", c64)
+			case ".jpg":
+				v = fmt.Sprintf("data:image/jpg;base64,%s", c64)
+			default:
+				return fmt.Errorf("only support png/jpg image")
+			}
+
+			err = w.WriteField(filedName, v)
+			if err != nil {
+				return err
+			}
+
+			return nil
+		}
+
+		if err := writeFile("logo", args.Logo); err != nil {
+			return err
+		}
+
+		if err := writeFile("login_logo", args.LoginLogo); err != nil {
+			return err
+		}
+
+		if err := writeFile("favicon", args.Favicon); err != nil {
+			return err
+		}
+
+		header := make(http.Header)
+		header.Set("content-type", fmt.Sprintf("multipart/form-data; boundary=%s", w.Boundary()))
+		w.Close()
+
+		ret, err := modules.Info.Update(s, header, bufio.NewReader(&b))
+		if err != nil {
+			return err
+		}
+
+		printObject(ret)
+		return nil
+	})
 }

cmd/climc/shell/dbinstance_backups.go

@@ -38,7 +38,11 @@ func init() {
 		if err != nil {
 			return err
 		}
-		printList(result, modules.DBInstanceBackups.GetColumns(s))
+		if len(opts.ExportFile) > 0 {
+			exportList(result, opts.ExportFile, opts.ExportKeys, opts.ExportTexts, modules.DBInstanceBackups.GetColumns(s))
+		} else {
+			printList(result, modules.DBInstanceBackups.GetColumns(s))
+		}
 		return nil
 	})
 

cmd/climc/shell/dbinstances.go

@@ -41,7 +41,12 @@ func init() {
 		if err != nil {
 			return err
 		}
-		printList(result, modules.DBInstance.GetColumns(s))
+
+		if len(opts.ExportFile) > 0 {
+			exportList(result, opts.ExportFile, opts.ExportKeys, opts.ExportTexts, modules.DBInstance.GetColumns(s))
+		} else {
+			printList(result, modules.DBInstance.GetColumns(s))
+		}
 		return nil
 	})
 

cmd/climc/shell/disks.go

@@ -291,4 +291,14 @@ func init() {
 		printObject(srv)
 		return nil
 	})
+
+	R(&DiskDetailOptions{}, "disk-change-owner-candidate-domains", "Get change owner candidate domain list", func(s *mcclient.ClientSession, args *DiskDetailOptions) error {
+		result, err := modules.Disks.GetSpecific(s, args.ID, "change-owner-candidate-domains", nil)
+		if err != nil {
+			return err
+		}
+		printObject(result)
+		return nil
+	})
+
 }

cmd/climc/shell/endpoints.go

@@ -64,14 +64,15 @@ func init() {
 	})
 
 	type EndpointCreateOptions struct {
-		SERVICE   string `help:"Service ID or Name"`
-		REGION    string `help:"Region"`
-		INTERFACE string `help:"Interface types" choices:"internal|public|admin|console"`
-		URL       string `help:"URL"`
-		Zone      string `help:"Zone"`
-		Name      string `help:"Name"`
-		Enabled   bool   `help:"Enabled"`
-		Disabled  bool   `help:"Disabled"`
+		SERVICE            string `help:"Service ID or Name"`
+		REGION             string `help:"Region"`
+		INTERFACE          string `help:"Interface types" choices:"internal|public|admin|console"`
+		URL                string `help:"URL"`
+		Zone               string `help:"Zone"`
+		Name               string `help:"Name"`
+		Enabled            bool   `help:"Enabled"`
+		Disabled           bool   `help:"Disabled"`
+		ServiceCertificate string `help:"Service certificate id or name"`
 	}
 	R(&EndpointCreateOptions{}, "endpoint-create", "Create endpoint", func(s *mcclient.ClientSession, args *EndpointCreateOptions) error {
 		params := jsonutils.NewDict()
@@ -95,6 +96,9 @@ func init() {
 		} else if !args.Enabled && args.Disabled {
 			params.Add(jsonutils.JSONFalse, "enabled")
 		}
+		if len(args.ServiceCertificate) > 0 {
+			params.Add(jsonutils.NewString(args.ServiceCertificate), "service_certificate")
+		}
 		ep, err := modules.EndpointsV3.Create(s, params)
 		if err != nil {
 			return err
@@ -104,11 +108,12 @@ func init() {
 	})
 
 	type EndpointUpdateOptions struct {
-		ID       string `help:"ID or name of endpoint"`
-		Url      string `help:"URL"`
-		Name     string `help:"Name"`
-		Enabled  bool   `help:"Enabled"`
-		Disabled bool   `help:"Disabled"`
+		ID                 string `help:"ID or name of endpoint"`
+		Url                string `help:"URL"`
+		Name               string `help:"Name"`
+		Enabled            bool   `help:"Enabled"`
+		Disabled           bool   `help:"Disabled"`
+		ServiceCertificate string `help:"Service certificate id or name"`
 	}
 	R(&EndpointUpdateOptions{}, "endpoint-update", "Update a endpoint", func(s *mcclient.ClientSession, args *EndpointUpdateOptions) error {
 		params := jsonutils.NewDict()
@@ -123,6 +128,9 @@ func init() {
 		} else if !args.Enabled && args.Disabled {
 			params.Add(jsonutils.JSONFalse, "enabled")
 		}
+		if len(args.ServiceCertificate) > 0 {
+			params.Add(jsonutils.NewString(args.ServiceCertificate), "service_certificate")
+		}
 		ep, err := modules.EndpointsV3.Patch(s, args.ID, params)
 		if err != nil {
 			return err

cmd/climc/shell/events.go

@@ -34,8 +34,8 @@ type BaseEventListOptions struct {
 	OrderBy    string   `help:"order by specific field"`
 	Action     []string `help:"Log action"`
 
-	User    []string `help:"filter by operator user"`
-	Project []string `help:"filter by owner project"`
+	User    string `help:"filter by operator user"`
+	Project string `help:"filter by owner project"`
 
 	PagingMarker string `help:"marker for pagination"`
 }
@@ -99,10 +99,10 @@ func doEventList(man modulebase.ResourceManager, s *mcclient.ClientSession, args
 		params.Add(jsonutils.NewStringArray(args.Action), "action")
 	}
 	if len(args.User) > 0 {
-		params.Add(jsonutils.NewStringArray(args.User), "user")
+		params.Add(jsonutils.NewString(args.User), "user")
 	}
 	if len(args.Project) > 0 {
-		params.Add(jsonutils.NewStringArray(args.Project), "project")
+		params.Add(jsonutils.NewString(args.Project), "project")
 	}
 	if len(args.Scope) > 0 {
 		params.Add(jsonutils.NewString(args.Scope), "scope")

cmd/climc/shell/globalvpcs.go

@@ -15,6 +15,8 @@
 package shell
 
 import (
+	"yunion.io/x/jsonutils"
+
 	"yunion.io/x/onecloud/pkg/mcclient"
 	"yunion.io/x/onecloud/pkg/mcclient/modules"
 	"yunion.io/x/onecloud/pkg/mcclient/options"
@@ -48,4 +50,32 @@ func init() {
 		printObject(result)
 		return nil
 	})
+
+	type GlobalVpcPublicOptions struct {
+		ID            string   `help:"ID or name of global vpc" json:"-"`
+		Scope         string   `help:"sharing scope" choices:"system|domain"`
+		SharedDomains []string `help:"share to domains"`
+	}
+	R(&GlobalVpcPublicOptions{}, "global-vpc-public", "Make global vpc public", func(s *mcclient.ClientSession, args *GlobalVpcPublicOptions) error {
+		params := jsonutils.Marshal(args)
+		result, err := modules.GlobalVpcs.PerformAction(s, args.ID, "public", params)
+		if err != nil {
+			return err
+		}
+		printObject(result)
+		return nil
+	})
+
+	type GlobalVpcPrivateOptions struct {
+		ID string `help:"ID or name of global vpc" json:"-"`
+	}
+	R(&GlobalVpcPrivateOptions{}, "global-vpc-private", "Make global vpc private", func(s *mcclient.ClientSession, args *GlobalVpcPrivateOptions) error {
+		params := jsonutils.Marshal(args)
+		result, err := modules.GlobalVpcs.PerformAction(s, args.ID, "private", params)
+		if err != nil {
+			return err
+		}
+		printObject(result)
+		return nil
+	})
 }

cmd/climc/shell/groups.go

@@ -224,4 +224,29 @@ func init() {
 			printObject(sp)
 			return nil
 		})
+
+	type GroupAddUsersOptions struct {
+		GROUP string   `help:"group Id or Name" json:"-"`
+		USER  []string `help:"list of user id or name" json:"user"`
+	}
+	R(&GroupAddUsersOptions{}, "group-add-users", "Add users into group",
+		func(s *mcclient.ClientSession, args *GroupAddUsersOptions) error {
+			params := jsonutils.Marshal(args)
+			result, err := modules.Groups.PerformAction(s, args.GROUP, "add-users", params)
+			if err != nil {
+				return err
+			}
+			printObject(result)
+			return nil
+		})
+	R(&GroupAddUsersOptions{}, "group-remove-users", "Add users into group",
+		func(s *mcclient.ClientSession, args *GroupAddUsersOptions) error {
+			params := jsonutils.Marshal(args)
+			result, err := modules.Groups.PerformAction(s, args.GROUP, "remove-users", params)
+			if err != nil {
+				return err
+			}
+			printObject(result)
+			return nil
+		})
 }

cmd/climc/shell/hosts.go

@@ -793,4 +793,26 @@ func init() {
 		printObject(result)
 		return nil
 	})
+
+	type HostAutoMigrateOnHostDownOptions struct {
+		ID      string `help:"ID or name of host"`
+		Enable  bool   `help:"enable auto migrate"`
+		Disable bool   `help:"disable auto migrate"`
+	}
+	R(&HostAutoMigrateOnHostDownOptions{}, "host-auto-migrate-on-host-down", "Get change owner candidate domain list", func(s *mcclient.ClientSession, args *HostAutoMigrateOnHostDownOptions) error {
+		params := jsonutils.NewDict()
+		if args.Disable {
+			params.Set("auto_migrate_on_host_down", jsonutils.NewString("disable"))
+		} else if args.Enable {
+			params.Set("auto_migrate_on_host_down", jsonutils.NewString("enable"))
+		} else {
+			return fmt.Errorf("missing input enable or disable")
+		}
+		result, err := modules.Hosts.PerformAction(s, args.ID, "auto-migrate-on-host-down", params)
+		if err != nil {
+			return err
+		}
+		printObject(result)
+		return nil
+	})
 }

cmd/climc/shell/images.go

@@ -34,6 +34,7 @@ type ImageOptionalOptions struct {
 	Unprotected        bool     `help:"Allow image to be deleted"`
 	Standard           bool     `help:"Mark image as a standard image"`
 	Nonstandard        bool     `help:"Mark image as a non-standard image"`
+	Public             bool     `help:"make image public"`
 	MinDisk            int64    `help:"Disk size after expanded, in MB" metavar:"MIN_DISK_SIZE_MB"`
 	MinRam             int64    `help:"Minimal memory size required" metavar:"MIN_RAM_MB"`
 	VirtualSize        int64    `help:"Disk size after expanded, in MB"`
@@ -57,7 +58,6 @@ type ImageOptionalOptions struct {
 
 func addImageOptionalOptions(s *mcclient.ClientSession, params *jsonutils.JSONDict, args ImageOptionalOptions) error {
 	if len(args.Format) > 0 {
-		params.Add(jsonutils.NewString("bare"), "container-format")
 		params.Add(jsonutils.NewString(args.Format), "disk-format")
 	}
 	if args.Protected && !args.Unprotected {
@@ -70,6 +70,9 @@ func addImageOptionalOptions(s *mcclient.ClientSession, params *jsonutils.JSONDi
 	} else if !args.Standard && args.Nonstandard {
 		params.Add(jsonutils.JSONFalse, "is_standard")
 	}
+	if args.Public {
+		params.Add(jsonutils.JSONTrue, "is_public")
+	}
 	if args.MinDisk > 0 {
 		params.Add(jsonutils.NewString(fmt.Sprintf("%d", args.MinDisk)), "min_disk")
 	}
@@ -140,6 +143,7 @@ func init() {
 		Protected  string   `help:"filter images by protected" choices:"true|false"`
 		IsUefi     bool     `help:"list uefi image"`
 		Format     []string `help:"Disk formats"`
+		SubFormats []string `help:"Sub formats"`
 		Name       string   `help:"Name filter"`
 	}
 	R(&ImageListOptions{}, "image-list", "List images", func(s *mcclient.ClientSession, args *ImageListOptions) error {
@@ -170,15 +174,14 @@ func init() {
 			params.Add(jsonutils.NewString(args.Name), "name")
 		}
 		if len(args.Format) > 0 {
-			if len(args.Format) == 1 {
-				params.Add(jsonutils.NewString(args.Format[0]), "disk_format")
-			} else {
-				fs := jsonutils.NewArray()
-				for _, f := range args.Format {
-					fs.Add(jsonutils.NewString(f))
-				}
-				params.Add(fs, "disk_formats")
+			fs := jsonutils.NewArray()
+			for _, f := range args.Format {
+				fs.Add(jsonutils.NewString(f))
 			}
+			params.Add(fs, "disk_formats")
+		}
+		if len(args.SubFormats) > 0 {
+			params.Add(jsonutils.Marshal(args.SubFormats), "sub_formats")
 		}
 		result, err := modules.Images.List(s, params)
 		if err != nil {
@@ -244,22 +247,6 @@ func init() {
 		return nil
 	})
 
-	type ImageMembershipOptions struct {
-		IMAGE   string `help:"ID or name of image to share"`
-		PROJECT string `help:"ID or name of project to share image with"`
-	}
-	type ImageMembershipAddOptions struct {
-		ImageMembershipOptions
-		CanShare bool `help:"Indicating whether the project can share the image with others"`
-	}
-	R(&ImageMembershipAddOptions{}, "image-add-project", "Add a project to private image's membership list", func(s *mcclient.ClientSession, args *ImageMembershipAddOptions) error {
-		return modules.Images.AddMembership(s, args.IMAGE, args.PROJECT, args.CanShare)
-	})
-
-	R(&ImageMembershipOptions{}, "image-remove-project", "Remove a project from private image's membership list", func(s *mcclient.ClientSession, args *ImageMembershipOptions) error {
-		return modules.Images.RemoveMembership(s, args.IMAGE, args.PROJECT)
-	})
-
 	type ImageDetailOptions struct {
 		ID string `help:"Image ID or name"`
 	}
@@ -278,19 +265,6 @@ func init() {
 		return nil
 	})
 
-	R(&ImageDetailOptions{}, "image-list-project", "List image members", func(s *mcclient.ClientSession, args *ImageDetailOptions) error {
-		imgId, e := modules.Images.GetId(s, args.ID, nil)
-		if e != nil {
-			return e
-		}
-		result, e := modules.Images.ListMemberProjects(s, imgId)
-		if e != nil {
-			return e
-		}
-		printList(result, modules.Projects.GetColumns(s))
-		return nil
-	})
-
 	type ImageCancelDeleteOptions struct {
 		ID string `help:"Image id or name" metavar:"IMAGE"`
 	}

cmd/climc/shell/loadbalancers.go

@@ -99,4 +99,13 @@ func init() {
 		return nil
 	})
 
+	R(&options.LoadbalancerGetOptions{}, "lb-change-owner-candidate-domains", "Get change owner candidate domain list", func(s *mcclient.ClientSession, args *options.LoadbalancerGetOptions) error {
+		result, err := modules.Loadbalancers.GetSpecific(s, args.ID, "change-owner-candidate-domains", nil)
+		if err != nil {
+			return err
+		}
+		printObject(result)
+		return nil
+	})
+
 }

cmd/climc/shell/networks.go

@@ -38,6 +38,7 @@ func init() {
 		City       string   `help:"search networks belongs to a city"`
 		Usable     *bool    `help:"search usable networks"`
 		ServerType string   `help:"search networks belongs to a ServerType" choices:"guest|baremetal|container|pxe|ipmi"`
+		Schedtag   string   `help:"filter networks by schedtag"`
 
 		Status string `help:"filter by network status"`
 	}
@@ -55,7 +56,11 @@ func init() {
 		if err != nil {
 			return err
 		}
-		printList(result, modules.Networks.GetColumns(s))
+		if len(opts.ExportFile) > 0 {
+			exportList(result, opts.ExportFile, opts.ExportKeys, opts.ExportTexts, modules.Networks.GetColumns(s))
+		} else {
+			printList(result, modules.Networks.GetColumns(s))
+		}
 		return nil
 	})
 
@@ -405,4 +410,21 @@ func init() {
 		printObject(result)
 		return nil
 	})
+
+	type NetworkChangeOwnerOptions struct {
+		ID      string `help:"Network to change owner" json:"-"`
+		PROJECT string `help:"Project ID or change" json:"tenant"`
+	}
+	R(&NetworkChangeOwnerOptions{}, "network-change-owner", "Change owner project of a network", func(s *mcclient.ClientSession, args *NetworkChangeOwnerOptions) error {
+		params, err := options.StructToParams(args)
+		if err != nil {
+			return err
+		}
+		net, err := modules.Networks.PerformAction(s, args.ID, "change-owner", params)
+		if err != nil {
+			return err
+		}
+		printObject(net)
+		return nil
+	})
 }

cmd/climc/shell/policies.go

@@ -15,6 +15,7 @@
 package shell
 
 import (
+	"context"
 	"fmt"
 	"io/ioutil"
 	"strings"
@@ -363,7 +364,7 @@ func init() {
 			token = s.GetToken()
 		}
 
-		result, err := policy.PolicyManager.ExplainRpc(token, req, args.Name)
+		result, err := policy.ExplainRpc(context.Background(), token, req, args.Name)
 		if err != nil {
 			return err
 		}
@@ -377,7 +378,7 @@ func init() {
 			rbacutils.ScopeUser,
 			rbacutils.ScopeNone,
 		} {
-			m := policy.PolicyManager.MatchedPolicies(scope, token)
+			m := policy.PolicyManager.MatchedPolicyNames(scope, token)
 			fmt.Println("matched", scope, "policies:", m)
 		}
 

cmd/climc/shell/scaling_group.go

@@ -41,6 +41,20 @@ func init() {
 		printList(result, modules.ScalingGroup.GetColumns(s))
 		return nil
 	})
+
+	type ScalingGroupShowOptions struct {
+		ID string
+	}
+	R(&ScalingGroupShowOptions{}, "scaling-group-show", "Show scaling group", func(s *mcclient.ClientSession,
+		args *ScalingGroupShowOptions) error {
+		result, err := modules.ScalingGroup.Get(s, args.ID, nil)
+		if err != nil {
+			return err
+		}
+		printObject(result)
+		return nil
+	})
+
 	type ScalingGroupCreateOptions struct {
 		NAME string
 

cmd/climc/shell/servers.go

@@ -988,6 +988,7 @@ func init() {
 				config.Hosts[i].HostIp = yamlConfig.Hosts[i].HostIp
 				config.Hosts[i].XmlFilePath = yamlConfig.Hosts[i].XmlFilePath
 				config.Hosts[i].Servers = make([]compute.SLibvirtServerConfig, len(yamlConfig.Hosts[i].Servers))
+				config.Hosts[i].MonitorPath = yamlConfig.Hosts[i].MonitorPath
 				for j := 0; j < len(yamlConfig.Hosts[i].Servers); j++ {
 					config.Hosts[i].Servers[j].MacIp = make(map[string]string)
 					mac := yamlConfig.Hosts[i].Servers[j].Mac
@@ -1010,11 +1011,11 @@ func init() {
 		if err != nil {
 			return err
 		}
-		for i := 0; i < len(params); i++ {
-			val := jsonutils.NewDict()
-			val.Set(modules.Servers.KeywordPlural, params[i])
-			params[i] = val
-		}
+		//for i := 0; i < len(params); i++ {
+		//	val := jsonutils.NewDict()
+		//	val.Set(modules.Servers.KeywordPlural, params[i])
+		//	params[i] = val
+		//}
 
 		results := modules.Servers.BatchPerformClassAction(s, "import-from-libvirt", params)
 		printBatchResults(results, modules.Servers.GetColumns(s))
@@ -1349,4 +1350,14 @@ func init() {
 		printObject(result)
 		return nil
 	})
+
+	R(&options.ServerShowOptions{}, "server-change-owner-candidate-domains", "Get change owner candidate domain list", func(s *mcclient.ClientSession, args *options.ServerShowOptions) error {
+		result, err := modules.Servers.GetSpecific(s, args.ID, "change-owner-candidate-domains", nil)
+		if err != nil {
+			return err
+		}
+		printObject(result)
+		return nil
+	})
+
 }

cmd/climc/shell/serversecgroups.go

@@ -0,0 +1,72 @@
+// Copyright 2019 Yunion
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//     http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
+package shell
+
+import (
+	"yunion.io/x/jsonutils"
+
+	"yunion.io/x/onecloud/pkg/mcclient"
+	"yunion.io/x/onecloud/pkg/mcclient/modulebase"
+	"yunion.io/x/onecloud/pkg/mcclient/modules"
+	"yunion.io/x/onecloud/pkg/mcclient/options"
+)
+
+func init() {
+	type ServerSecgroupListOptions struct {
+		options.BaseListOptions
+		Server   string `help:"ID or Name of Server"`
+		Secgroup string `help:"Secgroup ID or name"`
+	}
+	R(&ServerSecgroupListOptions{}, "server-secgroup-list", "List server secgroup pairs", func(s *mcclient.ClientSession, args *ServerSecgroupListOptions) error {
+		var params *jsonutils.JSONDict
+		{
+			var err error
+			params, err = args.BaseListOptions.Params()
+			if err != nil {
+				return err
+
+			}
+		}
+		var result *modulebase.ListResult
+		var err error
+		if len(args.Server) > 0 {
+			result, err = modules.Serversecgroups.ListDescendent(s, args.Server, params)
+		} else if len(args.Secgroup) > 0 {
+			result, err = modules.Serversecgroups.ListDescendent2(s, args.Secgroup, params)
+		} else {
+			result, err = modules.Serversecgroups.List(s, params)
+		}
+		if err != nil {
+			return err
+		}
+		printList(result, modules.Serversecgroups.GetColumns(s))
+		return nil
+	})
+
+	type ServerSecgroupDetailOptions struct {
+		SERVER   string `help:"ID or Name of Server"`
+		SECGROUP string `help:"ID or Name of Security Group"`
+	}
+	R(&ServerSecgroupDetailOptions{}, "server-secgroup-show", "Show server security group details", func(s *mcclient.ClientSession, args *ServerSecgroupDetailOptions) error {
+		query := jsonutils.NewDict()
+		result, err := modules.Serversecgroups.Get(s, args.SERVER, args.SECGROUP, query)
+		if err != nil {
+			return err
+		}
+		printObject(result)
+		return nil
+	})
+
+}

cmd/climc/shell/servicecertificates.go

@@ -0,0 +1,60 @@
+package shell
+
+import (
+	"yunion.io/x/onecloud/pkg/mcclient"
+	"yunion.io/x/onecloud/pkg/mcclient/modules"
+	"yunion.io/x/onecloud/pkg/mcclient/options"
+)
+
+func init() {
+	R(&options.ServiceCertificateCreateOptions{}, "service-cert-create", "Create service cert", func(s *mcclient.ClientSession, opts *options.ServiceCertificateCreateOptions) error {
+		params, err := opts.Params()
+		if err != nil {
+			return err
+		}
+		cert, err := modules.ServiceCertificatesV3.Create(s, params)
+		if err != nil {
+			return err
+		}
+		printObject(cert)
+		return nil
+	})
+	type ServiceCertificateGetOptions struct {
+		ID string `json:"-"`
+	}
+	R(&ServiceCertificateGetOptions{}, "service-cert-show", "Show service cert", func(s *mcclient.ClientSession, opts *ServiceCertificateGetOptions) error {
+		cert, err := modules.ServiceCertificatesV3.Get(s, opts.ID, nil)
+		if err != nil {
+			return err
+		}
+		printObject(cert)
+		return nil
+	})
+
+	type ServiceCertificateListOptions struct {
+		options.BaseListOptions
+	}
+	R(&ServiceCertificateListOptions{}, "service-cert-list", "List service certs", func(s *mcclient.ClientSession, opts *ServiceCertificateListOptions) error {
+		params, err := options.ListStructToParams(opts)
+		if err != nil {
+			return err
+		}
+		result, err := modules.ServiceCertificatesV3.List(s, params)
+		if err != nil {
+			return err
+		}
+		printList(result, modules.ServiceCertificatesV3.GetColumns(s))
+		return nil
+	})
+	type ServiceCertificateDeleteOptions struct {
+		ID string `json:"-"`
+	}
+	R(&ServiceCertificateDeleteOptions{}, "service-cert-delete", "Delete service cert", func(s *mcclient.ClientSession, opts *ServiceCertificateDeleteOptions) error {
+		cert, err := modules.ServiceCertificatesV3.Delete(s, opts.ID, nil)
+		if err != nil {
+			return err
+		}
+		printObject(cert)
+		return nil
+	})
+}

cmd/climc/shell/skus.go

@@ -25,13 +25,15 @@ import (
 func init() {
 	type ServerSkusListOptions struct {
 		options.BaseListOptions
-		Cloudregion string  `help:"region Id or name"`
-		Usable      bool    `help:"Filter usable sku"`
-		Zone        string  `help:"zone Id or name"`
-		City        *string `help:"city name,eg. BeiJing"`
-		Cpu         *int    `help:"Cpu core count" json:"cpu_core_count"`
-		Mem         *int    `help:"Memory size in MB" json:"memory_size_mb"`
-		Name        string  `help:"Name of Sku"`
+		Cloudregion    string  `help:"region Id or name"`
+		Usable         bool    `help:"Filter usable sku"`
+		Zone           string  `help:"zone Id or name"`
+		City           *string `help:"city name,eg. BeiJing"`
+		Cpu            *int    `help:"Cpu core count" json:"cpu_core_count"`
+		Mem            *int    `help:"Memory size in MB" json:"memory_size_mb"`
+		Name           string  `help:"Name of Sku"`
+		PostpaidStatus string  `help:"Postpaid status" choices:"soldout|available"`
+		PrepaidStatus  string  `help:"Prepaid status" choices:"soldout|available"`
 	}
 
 	R(&ServerSkusListOptions{}, "server-sku-list", "List all avaiable Server SKU", func(s *mcclient.ClientSession, args *ServerSkusListOptions) error {

cmd/climc/shell/storages.go

@@ -29,11 +29,12 @@ func init() {
 	type StorageListOptions struct {
 		options.BaseListOptions
 
-		Share  *bool  `help:"Share storage list"`
-		Local  *bool  `help:"Local storage list"`
-		Usable *bool  `help:"Usable storage list"`
-		Zone   string `help:"List storages in zone" json:"-"`
-		Region string `help:"List storages in region"`
+		Share    *bool  `help:"Share storage list"`
+		Local    *bool  `help:"Local storage list"`
+		Usable   *bool  `help:"Usable storage list"`
+		Zone     string `help:"List storages in zone" json:"-"`
+		Region   string `help:"List storages in region"`
+		Schedtag string `help:"filter storage by schedtag"`
 	}
 	R(&StorageListOptions{}, "storage-list", "List storages", func(s *mcclient.ClientSession, opts *StorageListOptions) error {
 		params, err := options.ListStructToParams(opts)
@@ -215,4 +216,63 @@ func init() {
 		printObject(storage)
 		return nil
 	})
+
+	type StorageChangeOwnerOptions struct {
+		ID            string `help:"ID or name of storage" json:"-"`
+		ProjectDomain string `json:"project_domain" help:"target domain"`
+	}
+	R(&StorageChangeOwnerOptions{}, "storage-change-owner", "Change owner domain of storage", func(s *mcclient.ClientSession, args *StorageChangeOwnerOptions) error {
+		if len(args.ProjectDomain) == 0 {
+			return fmt.Errorf("empty project_domain")
+		}
+		params := jsonutils.Marshal(args)
+		ret, err := modules.Storages.PerformAction(s, args.ID, "change-owner", params)
+		if err != nil {
+			return err
+		}
+		printObject(ret)
+		return nil
+	})
+
+	type StorageForceDetachHost struct {
+		ID   string `help:"ID or name of storage" json:"-"`
+		Host string `help:"ID or name of host"`
+	}
+	R(&StorageForceDetachHost{}, "storage-public", "Force detach host", func(s *mcclient.ClientSession, args *StorageForceDetachHost) error {
+		params := jsonutils.Marshal(args)
+		result, err := modules.Storages.PerformAction(s, args.ID, "force-detach-host", params)
+		if err != nil {
+			return err
+		}
+		printObject(result)
+		return nil
+	})
+
+	type StoragePublicOptions struct {
+		ID            string   `help:"ID or name of storage" json:"-"`
+		Scope         string   `help:"sharing scope" choices:"system|domain"`
+		SharedDomains []string `help:"share to domains"`
+	}
+	R(&StoragePublicOptions{}, "storage-public", "Make a storage public", func(s *mcclient.ClientSession, args *StoragePublicOptions) error {
+		params := jsonutils.Marshal(args)
+		result, err := modules.Storages.PerformAction(s, args.ID, "public", params)
+		if err != nil {
+			return err
+		}
+		printObject(result)
+		return nil
+	})
+
+	type StoragePrivateOptions struct {
+		ID string `help:"ID or name of storage" json:"-"`
+	}
+	R(&StoragePrivateOptions{}, "storage-private", "Make a storage private", func(s *mcclient.ClientSession, args *StoragePrivateOptions) error {
+		params := jsonutils.Marshal(args)
+		result, err := modules.Storages.PerformAction(s, args.ID, "private", params)
+		if err != nil {
+			return err
+		}
+		printObject(result)
+		return nil
+	})
 }

cmd/climc/shell/users.go

@@ -40,7 +40,11 @@ func init() {
 		if err != nil {
 			return err
 		}
-		printList(result, modules.UsersV3.GetColumns(s))
+		if len(args.ExportFile) > 0 {
+			exportList(result, args.ExportFile, args.ExportKeys, args.ExportTexts, modules.UsersV3.GetColumns(s))
+		} else {
+			printList(result, modules.UsersV3.GetColumns(s))
+		}
 		return nil
 	})
 

cmd/climc/shell/vpcs.go

@@ -15,6 +15,8 @@
 package shell
 
 import (
+	"fmt"
+
 	"yunion.io/x/jsonutils"
 
 	"yunion.io/x/onecloud/pkg/mcclient"
@@ -47,7 +49,11 @@ func init() {
 			return err
 		}
 
-		printList(result, modules.Vpcs.GetColumns(s))
+		if len(opts.ExportFile) > 0 {
+			exportList(result, opts.ExportFile, opts.ExportKeys, opts.ExportTexts, modules.Vpcs.GetColumns(s))
+		} else {
+			printList(result, modules.Vpcs.GetColumns(s))
+		}
 		return nil
 	})
 
@@ -214,4 +220,21 @@ func init() {
 		printObject(result)
 		return nil
 	})
+
+	type VpcChangeOwnerOptions struct {
+		ID            string `help:"ID or name of vpc" json:"-"`
+		ProjectDomain string `json:"project_domain" help:"target domain"`
+	}
+	R(&VpcChangeOwnerOptions{}, "vpc-change-owner", "Change owner domain of vpc", func(s *mcclient.ClientSession, args *VpcChangeOwnerOptions) error {
+		if len(args.ProjectDomain) == 0 {
+			return fmt.Errorf("empty project_domain")
+		}
+		params := jsonutils.Marshal(args)
+		ret, err := modules.Vpcs.PerformAction(s, args.ID, "change-owner", params)
+		if err != nil {
+			return err
+		}
+		printObject(ret)
+		return nil
+	})
 }

go.mod

@@ -3,7 +3,6 @@ module yunion.io/x/onecloud
 go 1.12
 
 require (
-	cloud.google.com/go v0.50.0
 	cloud.google.com/go/storage v1.5.0
 	github.com/360EntSecGroup-Skylar/excelize v1.4.0
 	github.com/Azure/azure-sdk-for-go v36.1.0+incompatible
@@ -130,10 +129,10 @@ require (
 	yunion.io/x/executor v0.0.0-20200227030256-a18417815e74
 	yunion.io/x/jsonutils v0.0.0-20200415132054-2bf8a5e94501
 	yunion.io/x/log v0.0.0-20200313080802-57a4ce5966b3
-	yunion.io/x/pkg v0.0.0-20200416145704-22c189971435
+	yunion.io/x/pkg v0.0.0-20200516092703-0a53bc9270aa
 	yunion.io/x/s3cli v0.0.0-20190917004522-13ac36d8687e
 	yunion.io/x/sqlchemy v0.0.0-20200312002602-1177cd8fbc57
-	yunion.io/x/structarg v0.0.0-20190809075558-115bed041de3
+	yunion.io/x/structarg v0.0.0-20200423163001-168d0687be7e
 )
 
 replace (

go.sum

@@ -1116,11 +1116,11 @@ yunion.io/x/log v0.0.0-20200313080802-57a4ce5966b3/go.mod h1:LC6f/4FozL0iaAbnFt2
 yunion.io/x/pkg v0.0.0-20190620104149-945c25821dbf/go.mod h1:t6rEGG2sQ4J7DhFxSZVOTjNd0YO/KlfWQyK1W4tog+E=
 yunion.io/x/pkg v0.0.0-20190628082551-f4033ba2ea30/go.mod h1:t6rEGG2sQ4J7DhFxSZVOTjNd0YO/KlfWQyK1W4tog+E=
 yunion.io/x/pkg v0.0.0-20200302034534-fdf44d54b070/go.mod h1:t6rEGG2sQ4J7DhFxSZVOTjNd0YO/KlfWQyK1W4tog+E=
-yunion.io/x/pkg v0.0.0-20200416145704-22c189971435 h1:Fwf1rjdl+Qmw9BNxQN7wi2lQpYVExV7eBLifd0emHaI=
-yunion.io/x/pkg v0.0.0-20200416145704-22c189971435/go.mod h1:t6rEGG2sQ4J7DhFxSZVOTjNd0YO/KlfWQyK1W4tog+E=
+yunion.io/x/pkg v0.0.0-20200516092703-0a53bc9270aa h1:VizPfW8+mLFEE7W/97zxQJbfdxchi2dn1M/Y7YBwTTc=
+yunion.io/x/pkg v0.0.0-20200516092703-0a53bc9270aa/go.mod h1:t6rEGG2sQ4J7DhFxSZVOTjNd0YO/KlfWQyK1W4tog+E=
 yunion.io/x/s3cli v0.0.0-20190917004522-13ac36d8687e h1:v+EzIadodSwkdZ/7bremd7J8J50Cise/HCylsOJngmo=
 yunion.io/x/s3cli v0.0.0-20190917004522-13ac36d8687e/go.mod h1:0iFKpOs1y4lbCxeOmq3Xx/0AcQoewVPwj62eRluioEo=
 yunion.io/x/sqlchemy v0.0.0-20200312002602-1177cd8fbc57 h1:KtQAuLJ00RSUVqkiRmJ1DiDABiw0U3xxXnzD3lGavaY=
 yunion.io/x/sqlchemy v0.0.0-20200312002602-1177cd8fbc57/go.mod h1:FTdwPdGhMgh4E+UFXc9klI1Ok34fMuybTT+jLhOaIjI=
-yunion.io/x/structarg v0.0.0-20190809075558-115bed041de3 h1:bfC8EhXYvyGYldRWlzxiCM39Zfj3s3+zham9mW2h2LE=
-yunion.io/x/structarg v0.0.0-20190809075558-115bed041de3/go.mod h1:EP6NSv2C0zzqBDTKumv8hPWLb3XvgMZDHQRfyuOrQng=
+yunion.io/x/structarg v0.0.0-20200423163001-168d0687be7e h1:pctCe/EPel3F1B83pJ2q9b34Umd1NdbLW1Yd+Lzur2s=
+yunion.io/x/structarg v0.0.0-20200423163001-168d0687be7e/go.mod h1:EP6NSv2C0zzqBDTKumv8hPWLb3XvgMZDHQRfyuOrQng=

pkg/apigateway/handler/auth.go

@@ -16,6 +16,7 @@ package handler
 
 import (
 	"context"
+	"encoding/base64"
 	"fmt"
 	"net/http"
 	"strings"
@@ -269,6 +270,10 @@ func (h *AuthHandlers) doCredentialLogin(ctx context.Context, req *http.Request,
 		if err != nil {
 			return nil, httperrors.NewInputParameterError("get password in body")
 		}
+		// try base64 decryption
+		if decPasswd, err := base64.StdEncoding.DecodeString(passwd); err == nil {
+			passwd = string(decPasswd)
+		}
 		if len(uname) == 0 || len(passwd) == 0 {
 			return nil, httperrors.NewInputParameterError("username or password is empty")
 		}
@@ -314,6 +319,35 @@ func (h *AuthHandlers) doCredentialLogin(ctx context.Context, req *http.Request,
 			}
 		}
 	}
+	if len(tenant) == 0 {
+		token3, ok := token.(*mcclient.TokenCredentialV3)
+		if ok {
+			targetLevel := rbacutils.ScopeProject
+			targetProjId := ""
+			for _, r := range token3.Token.RoleAssignments {
+				level := rbacutils.ScopeProject
+				if len(r.Policies.System) > 0 {
+					level = rbacutils.ScopeSystem
+				} else if len(r.Policies.Domain) > 0 {
+					level = rbacutils.ScopeDomain
+				}
+				if len(targetProjId) == 0 || level.HigherThan(targetLevel) {
+					targetProjId = r.Scope.Project.Id
+					targetLevel = level
+				}
+			}
+			if len(targetProjId) > 0 {
+				ntoken, e := auth.Client().SetProject(targetProjId, "", "", token)
+				if e != nil {
+					log.Errorf("fail to change to project %s(%s), reset to empty", targetProjId, e)
+				} else {
+					token = ntoken
+					tenant = targetProjId
+					body.(*jsonutils.JSONDict).Set("scope", jsonutils.NewString(string(targetLevel)))
+				}
+			}
+		}
+	}
 	if len(tenant) == 0 {
 		s := auth.GetAdminSession(ctx, FetchRegion(req), "")
 		projects, e := modules.UsersV3.GetProjects(s, token.GetUserId())
@@ -367,7 +401,7 @@ func isUserAllowWebconsole(ctx context.Context, w http.ResponseWriter, req *http
 	return true
 }
 
-func saveCookie(w http.ResponseWriter, name, val string, expire time.Time, base64 bool) {
+func saveCookie(w http.ResponseWriter, name, val, domain string, expire time.Time, base64 bool) {
 	diff := time.Until(expire)
 	maxAge := int(diff.Seconds())
 	// log.Println("Set cookie", name, expire, maxAge, val)
@@ -379,6 +413,11 @@ func saveCookie(w http.ResponseWriter, name, val string, expire time.Time, base6
 	}
 	// log.Printf("Set coookie: %s - %s\n", val, valenc)
 	cookie := &http.Cookie{Name: name, Value: valenc, Path: "/", Expires: expire, MaxAge: maxAge, HttpOnly: false}
+
+	if len(domain) > 0 {
+		cookie.Domain = domain
+	}
+
 	http.SetCookie(w, cookie)
 }
 
@@ -400,8 +439,12 @@ func getCookie(r *http.Request, name string) string {
 	}
 }
 
-func clearCookie(w http.ResponseWriter, name string) {
+func clearCookie(w http.ResponseWriter, name string, domain string) {
 	cookie := &http.Cookie{Name: name, Expires: time.Now(), Path: "/", MaxAge: -1, HttpOnly: false}
+	if len(domain) > 0 {
+		cookie.Domain = domain
+	}
+
 	http.SetCookie(w, cookie)
 }
 
@@ -458,7 +501,7 @@ func (h *AuthHandlers) postLoginHandler(ctx context.Context, w http.ResponseWrit
 		httperrors.GeneralServerError(w, err)
 		return
 	}
-	saveCookie(w, constants.YUNION_AUTH_COOKIE, authCookie, token.GetExpires(), true)
+	saveCookie(w, constants.YUNION_AUTH_COOKIE, authCookie, options.Options.CookieDomain, token.GetExpires(), true)
 
 	if len(token.GetProjectId()) > 0 {
 		if body.Contains("isadmin") {
@@ -466,20 +509,20 @@ func (h *AuthHandlers) postLoginHandler(ctx context.Context, w http.ResponseWrit
 			if policy.PolicyManager.IsScopeCapable(token, rbacutils.ScopeSystem) {
 				adminVal, _ = body.GetString("isadmin")
 			}
-			saveCookie(w, "isadmin", adminVal, token.GetExpires(), false)
+			saveCookie(w, "isadmin", adminVal, "", token.GetExpires(), false)
 		}
 		if body.Contains("scope") {
 			scopeStr, _ := body.GetString("scope")
 			if !policy.PolicyManager.IsScopeCapable(token, rbacutils.TRbacScope(scopeStr)) {
 				scopeStr = string(rbacutils.ScopeProject)
 			}
-			saveCookie(w, "scope", scopeStr, token.GetExpires(), false)
+			saveCookie(w, "scope", scopeStr, "", token.GetExpires(), false)
 		}
 		if body.Contains("domain") {
 			domainStr, _ := body.GetString("domain")
-			saveCookie(w, "domain", domainStr, token.GetExpires(), false)
+			saveCookie(w, "domain", domainStr, "", token.GetExpires(), false)
 		}
-		saveCookie(w, "tenant", token.GetProjectId(), token.GetExpires(), false)
+		saveCookie(w, "tenant", token.GetProjectId(), "", token.GetExpires(), false)
 	}
 
 	setAuthHeader(w, tid)
@@ -502,7 +545,7 @@ func (h *AuthHandlers) postLogoutHandler(ctx context.Context, w http.ResponseWri
 	if len(tid) > 0 {
 		clientman.TokenMan.Remove(tid)
 	}
-	clearCookie(w, constants.YUNION_AUTH_COOKIE)
+	clearCookie(w, constants.YUNION_AUTH_COOKIE, options.Options.CookieDomain)
 	appsrv.Send(w, "")
 }
 
@@ -533,14 +576,6 @@ func FetchRegion(req *http.Request) string {
 	return ""
 }
 
-func fetchDomain(req *http.Request) string {
-	r, e := req.Cookie("domain")
-	if e != nil {
-		return ""
-	}
-	return r.Value
-}
-
 type role struct {
 	id   string
 	name string
@@ -570,6 +605,7 @@ func (this *projectRoles) add(roleId, roleName string) {
 
 func (this *projectRoles) getToken(scope rbacutils.TRbacScope, user, userId, domain, domainId string, ip string) mcclient.TokenCredential {
 	return &mcclient.SSimpleToken{
+		Token:           "faketoken",
 		Domain:          domain,
 		DomainId:        domainId,
 		User:            user,
@@ -609,12 +645,12 @@ func (this *projectRoles) json(user, userId, domain, domainId string, ip string)
 	}
 	obj.Add(roles, "roles")
 	for _, scope := range []rbacutils.TRbacScope{
-		rbacutils.ScopeSystem,
-		rbacutils.ScopeDomain,
 		rbacutils.ScopeProject,
+		rbacutils.ScopeDomain,
+		rbacutils.ScopeSystem,
 	} {
 		token := this.getToken(scope, user, userId, domain, domainId, ip)
-		matches := policy.PolicyManager.MatchedPolicies(scope, token)
+		matches := policy.PolicyManager.MatchedPolicyNames(scope, token)
 		obj.Add(jsonutils.NewStringArray(matches), fmt.Sprintf("%s_policies", scope))
 		if len(matches) > 0 {
 			obj.Add(jsonutils.JSONTrue, fmt.Sprintf("%s_capable", scope))
@@ -646,26 +682,74 @@ func getUserAuthCookie(ctx context.Context, s *mcclient.ClientSession, token mcc
 	return info.String(), nil
 }
 
-func getLBAgentInfo(s *mcclient.ClientSession, token mcclient.TokenCredential) (*jsonutils.JSONDict, error) {
+func isLBAgentExists(s *mcclient.ClientSession) (bool, error) {
 	params := jsonutils.NewDict()
 	params.Add(jsonutils.NewString("hb_last_seen.isnotempty()"), "filter.0")
 	params.Add(jsonutils.NewInt(1), "limit")
 	params.Add(jsonutils.JSONFalse, "details")
-	lbagents, err := modules.LoadbalancerAgents.List(s, params)
+	agents, err := modules.LoadbalancerAgents.List(s, params)
 	if err != nil {
-		return nil, errors.Wrapf(err, "user %s get lbagent", token.GetUserName())
+		return false, errors.Wrap(err, "modules.LoadbalancerAgents.List")
 	}
 
-	item := jsonutils.NewDict()
-	item.Add(jsonutils.NewString(""), "name")
-	item.Add(jsonutils.NewString("lbagent"), "type")
-	item.Add(jsonutils.JSONTrue, "as_menu")
-	if len(lbagents.Data) > 0 {
-		item.Add(jsonutils.JSONTrue, "status")
+	if len(agents.Data) > 0 {
+		return true, nil
 	} else {
-		item.Add(jsonutils.JSONFalse, "status")
+		return false, nil
+	}
+}
+
+func isBaremetalAgentExists(s *mcclient.ClientSession) (bool, error) {
+	params := jsonutils.NewDict()
+	params.Add(jsonutils.NewString("agent_type.equals(baremetal)"), "filter.0")
+	params.Add(jsonutils.NewInt(1), "limit")
+	params.Add(jsonutils.JSONFalse, "details")
+	agents, err := modules.Baremetalagents.List(s, params)
+	if err != nil {
+		return false, errors.Wrap(err, "modules.Baremetalagents.List")
+	}
+
+	if len(agents.Data) > 0 {
+		return true, nil
+	} else {
+		return false, nil
+	}
+}
+
+func isEsxiAgentExists(s *mcclient.ClientSession) (bool, error) {
+	params := jsonutils.NewDict()
+	params.Add(jsonutils.NewString("agent_type.equals(esxiagent)"), "filter.0")
+	params.Add(jsonutils.NewInt(1), "limit")
+	params.Add(jsonutils.JSONFalse, "details")
+	agents, err := modules.Baremetalagents.List(s, params)
+	if err != nil {
+		return false, errors.Wrap(err, "modules.Baremetalagents.List esxiagent")
+	}
+
+	if len(agents.Data) > 0 {
+		return true, nil
+	} else {
+		return false, nil
+	}
+}
+
+func isHostAgentExists(s *mcclient.ClientSession) (bool, error) {
+	params := jsonutils.NewDict()
+	params.Add(jsonutils.JSONFalse, "show_emulated")
+	params.Add(jsonutils.JSONFalse, "baremetal")
+	params.Add(jsonutils.NewString("system"), "scope")
+	params.Add(jsonutils.NewInt(1), "limit")
+	params.Add(jsonutils.JSONFalse, "details")
+	agents, err := modules.Hosts.List(s, params)
+	if err != nil {
+		return false, errors.Wrap(err, "modules.LoadbalancerAgents.List")
+	}
+
+	if len(agents.Data) > 0 {
+		return true, nil
+	} else {
+		return false, nil
 	}
-	return item, nil
 }
 
 func getUserInfo(ctx context.Context, s *mcclient.ClientSession, token mcclient.TokenCredential, req *http.Request) (*jsonutils.JSONDict, error) {
@@ -741,7 +825,7 @@ func getUserInfo(ctx context.Context, s *mcclient.ClientSession, token mcclient.
 		rbacutils.ScopeDomain,
 		rbacutils.ScopeProject,
 	} {
-		p := policy.PolicyManager.MatchedPolicies(scope, token)
+		p := policy.PolicyManager.MatchedPolicyNames(scope, token)
 		data.Add(jsonutils.NewStringArray(p), fmt.Sprintf("%s_policies", scope))
 		if scope == rbacutils.ScopeSystem {
 			data.Add(jsonutils.NewStringArray(p), "admin_policies")
@@ -756,43 +840,57 @@ func getUserInfo(ctx context.Context, s *mcclient.ClientSession, token mcclient.
 	menus := jsonutils.NewArray()
 	k8s := jsonutils.NewArray()
 
-	adminToken := auth.AdminCredential()
 	curReg := FetchRegion(req)
-	allsrv := adminToken.GetInternalServices(curReg)
-	alleps := auth.Client().GetServiceCatalog().GetServicesByInterface(curReg, "console")
-
-	if allsrv != nil && len(allsrv) > 0 {
-		for _, srv := range allsrv {
-			item := jsonutils.NewDict()
-			item.Add(jsonutils.NewString(""), "name")
-			item.Add(jsonutils.NewString(srv), "type")
-			item.Add(jsonutils.JSONTrue, "status")
-			if srv == "notify" {
-				item.Add(jsonutils.JSONFalse, "as_menu")
-			} else {
-				item.Add(jsonutils.JSONTrue, "as_menu")
-			}
-			services.Add(item)
-		}
-	} else {
-		log.Errorf("fail to find services????: %#v %s", adminToken, curReg)
+	srvCat := auth.Client().GetServiceCatalog()
+	var allsrv []string
+	var alleps []mcclient.ExternalService
+	if srvCat != nil {
+		allsrv = srvCat.GetInternalServices(curReg)
+		alleps = srvCat.GetServicesByInterface(curReg, "console")
 	}
 
-	log.Infof("getUserInfo getLBAgentInfo")
-	lb, err := getLBAgentInfo(s, adminToken)
-	if err != nil {
-		log.Errorf("getLBAgentInfo fail %s", err)
-	} else {
-		services.Add(lb)
+	log.Infof("getUserInfo checkAgent exists")
+	for _, cf := range []struct {
+		existFunc func(*mcclient.ClientSession) (bool, error)
+		srvName   string
+	}{
+		{
+			existFunc: isLBAgentExists,
+			srvName:   "lbagent",
+		},
+		{
+			existFunc: isBaremetalAgentExists,
+			srvName:   "bmagent",
+		},
+		{
+			existFunc: isHostAgentExists,
+			srvName:   "hostagent",
+		},
+		{
+			existFunc: isEsxiAgentExists,
+			srvName:   "esxiagent",
+		},
+	} {
+		exist, err := cf.existFunc(s)
+		if err != nil {
+			log.Errorf("isLBAgentExists fail %s", err)
+		} else if exist {
+			allsrv = append(allsrv, cf.srvName)
+		}
 	}
 
-	if alleps != nil {
-		for _, ep := range alleps {
-			item := jsonutils.NewDict()
-			item.Add(jsonutils.NewString(ep.Url), "url")
-			item.Add(jsonutils.NewString(ep.Name), "name")
-			menus.Add(item)
-		}
+	for _, srv := range allsrv {
+		item := jsonutils.NewDict()
+		item.Add(jsonutils.NewString(srv), "type")
+		item.Add(jsonutils.JSONTrue, "status")
+		services.Add(item)
+	}
+
+	for _, ep := range alleps {
+		item := jsonutils.NewDict()
+		item.Add(jsonutils.NewString(ep.Url), "url")
+		item.Add(jsonutils.NewString(ep.Name), "name")
+		menus.Add(item)
 	}
 
 	log.Infof("getUserInfo modules.Hosts.Get")
@@ -853,7 +951,7 @@ func (h *AuthHandlers) getPermissionDetails(ctx context.Context, w http.Response
 	if query != nil {
 		name, _ = query.GetString("policy")
 	}
-	result, err := policy.PolicyManager.ExplainRpc(t, body, name)
+	result, err := policy.ExplainRpc(ctx, t, body, name)
 	if err != nil {
 		httperrors.GeneralServerError(w, err)
 		return
@@ -987,20 +1085,14 @@ func (h *AuthHandlers) resetUserPassword(ctx context.Context, w http.ResponseWri
 	confirmPwd, _ := body.GetString("password_confirm")
 	passcode, _ := body.GetString("passcode")
 
-	// 1.验证新密码正确
-	if len(newPwd) < 6 {
-		httperrors.InputParameterError(w, "new password must have at least 6 characters")
-		return
-	}
-
 	if newPwd != confirmPwd {
 		httperrors.InputParameterError(w, "new password mismatch")
 		return
 	}
 
-	// 2.验证原密码正确，且idp_driver为空
+	// 1.验证原密码正确，且idp_driver为空
 	if isLdapUser(user) {
-		httperrors.ForbiddenError(w, "not support reset ldap user password")
+		httperrors.ForbiddenError(w, "not support reset user password")
 		return
 	}
 
@@ -1018,7 +1110,7 @@ func (h *AuthHandlers) resetUserPassword(ctx context.Context, w http.ResponseWri
 		return
 	}
 
-	// 3.如果已开启MFA，验证 随机密码正确
+	// 2.如果已开启MFA，验证 随机密码正确
 	tid := getAuthToken(req)
 	if isMfaEnabled(user) {
 		totp := clientman.TokenMan.GetTotp(tid)
@@ -1029,7 +1121,7 @@ func (h *AuthHandlers) resetUserPassword(ctx context.Context, w http.ResponseWri
 		}
 	}
 
-	// 4.重置密码，清除认证token
+	// 3.重置密码，清除认证token
 	params := jsonutils.NewDict()
 	params.Set("password", jsonutils.NewString(newPwd))
 	ret, err := modules.UsersV3.Patch(s, uid, params)
@@ -1044,7 +1136,7 @@ func (h *AuthHandlers) resetUserPassword(ctx context.Context, w http.ResponseWri
 }
 
 func isLdapUser(user jsonutils.JSONObject) bool {
-	if driver, _ := user.GetString("idp_driver"); driver == "ldap" {
+	if driver, _ := user.GetString("idp_driver"); len(driver) > 0 {
 		return true
 	}
 

pkg/apigateway/handler/init.go

@@ -0,0 +1,19 @@
+// Copyright 2019 Yunion
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//     http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
+package handler
+
+import (
+	_ "yunion.io/x/onecloud/pkg/mcclient/modules/cloudnet"
+)

pkg/apigateway/options/options.go

@@ -20,6 +20,7 @@ import (
 
 type GatewayOptions struct {
 	DefaultRegion string `help:"Use default region while region not specific in api request"`
+	CookieDomain  string `help:"specific yunionauth cookie domain" default:""`
 
 	Timeout int `help:"Timeout in seconds, default is 300" default:"300"`
 

pkg/apis/baremetal/consts.go

@@ -0,0 +1,20 @@
+// Copyright 2019 Yunion
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//     http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
+package baremetal
+
+const (
+	SERVICE_TYPE    = "baremetal"
+	SERVICE_VERSION = ""
+)

pkg/apis/baremetal/doc.go

@@ -1,4 +1,4 @@
-// Copyright 2017, OpenCensus Authors
+// Copyright 2019 Yunion
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
@@ -12,8 +12,4 @@
 // See the License for the specific language governing permissions and
 // limitations under the License.
 
-// Package ocgrpc contains OpenCensus stats and trace
-// integrations for gRPC.
-//
-// Use ServerHandler for servers and ClientHandler for clients.
-package ocgrpc // import "go.opencensus.io/plugin/ocgrpc"
+package baremetal // import "yunion.io/x/onecloud/pkg/apis/baremetal"

pkg/apis/cloudevent/cloudevent.go

@@ -22,9 +22,21 @@ import (
 )
 
 type CloudeventListInput struct {
-	apis.VirtualResourceListInput
+	apis.ModelBaseListInput
 
-	compute.ManagedResourceListInput
+	compute.CloudenvResourceListInput
+
+	// 服务类型
+	Service []string `json:"service"`
+
+	// 订阅
+	Manager []string `json:"manager"`
+
+	// 账号
+	Account []string `json:"account"`
+
+	// 操作类型
+	Action []string `json:"action"`
 
 	// 操作日志起始时间
 	Since time.Time `json:"since"`

pkg/apis/compute/cachedloadbalanceracl.go

@@ -28,4 +28,26 @@ type CachedLoadbalancerAclListInput struct {
 	apis.SharableVirtualResourceListInput
 	RegionalFilterListInput
 	ManagedResourceListInput
+	LoadbalancerAclFilterListInput
+}
+
+type LoadbalancerAclResourceInfo struct {
+	// 负载均衡ACL名称
+	Acl string `json:"acl"`
+}
+
+type LoadbalancerAclResourceInput struct {
+	// ACL名称或ID
+	Acl string `json:"acl"`
+
+	// swagger:ignore
+	// Deprecated
+	AclId string `json:"acl_id" "yunion:deprecated-by":"acl"`
+}
+
+type LoadbalancerAclFilterListInput struct {
+	LoadbalancerAclResourceInput
+
+	// 以ACL名称排序
+	OrderByAcl string `json:"order_by_acl"`
 }

pkg/apis/compute/cloudaccount.go

@@ -167,10 +167,11 @@ type CloudaccountCreateInput struct {
 	IsOnPremise bool
 
 	// 指定云账号所属的项目
-	Tenant string `json:"tenant"`
-
+	// Tenant string `json:"tenant"`
 	// swagger:ignore
-	TenantId string
+	// TenantId string
+
+	apis.ProjectizedResourceInput
 
 	// 启用自动同步
 	// default: false
@@ -222,6 +223,11 @@ type CloudaccountListInput struct {
 
 	// 共享模式
 	ShareMode []string `json:"share_mode"`
+
+	// 代理
+	ProxySetting string `json:"proxy_setting"`
+	// swagger:ignore
+	ProxySettingId string `json:"proxy_setting_id" "yunion:deprecated-by":"proxy_setting"`
 }
 
 type ProviderProject struct {
@@ -313,7 +319,7 @@ type CloudaccountUpdateInput struct {
 }
 
 type CloudaccountPerformPublicInput struct {
-	apis.PerformPublicInput
+	apis.PerformPublicDomainInput
 
 	// 共享模式，可能值为provider_domain, system
 	// example: provider_domain

pkg/apis/compute/cloudaccount_const.go

@@ -15,6 +15,7 @@
 package compute
 
 import (
+	"yunion.io/x/onecloud/pkg/apis"
 	"yunion.io/x/onecloud/pkg/cloudprovider"
 )
 
@@ -103,9 +104,9 @@ const (
 )
 
 const (
-	CLOUD_ACCOUNT_SHARE_MODE_ACCOUNT_DOMAIN  = "account_domain"
-	CLOUD_ACCOUNT_SHARE_MODE_SYSTEM          = "system"
-	CLOUD_ACCOUNT_SHARE_MODE_PROVIDER_DOMAIN = "provider_domain"
+	CLOUD_ACCOUNT_SHARE_MODE_ACCOUNT_DOMAIN  = apis.CLOUD_ACCOUNT_SHARE_MODE_ACCOUNT_DOMAIN
+	CLOUD_ACCOUNT_SHARE_MODE_SYSTEM          = apis.CLOUD_ACCOUNT_SHARE_MODE_SYSTEM
+	CLOUD_ACCOUNT_SHARE_MODE_PROVIDER_DOMAIN = apis.CLOUD_ACCOUNT_SHARE_MODE_PROVIDER_DOMAIN
 )
 
 var (

pkg/apis/compute/cloudprovider.go

@@ -181,7 +181,7 @@ type ManagedResourceListInput struct {
 
 	// 过滤资源，是否为非OneCloud内置私有云管理的资源
 	// default: false
-	IsManaged bool `json:"is_managed"`
+	IsManaged *bool `json:"is_managed"`
 
 	// 以云账号名称排序
 	// pattern:asc|desc
@@ -222,6 +222,10 @@ type CloudproviderListInput struct {
 
 	UsableResourceListInput
 
+	CloudregionResourceInput
+
+	ZoneResourceInput
+
 	CapabilityListInput
 
 	SyncableBaseResourceListInput

pkg/apis/compute/cloudregions_const.go

@@ -56,6 +56,7 @@ const (
 	CITY_NAN_JING      = "Nanjing"     //南京
 	CITY_FO_SHAN       = "Foshan"      //佛山
 	CITY_QUAN_ZHOU     = "Quanzhou"    //泉州
+	CITY_NEI_MENG_GU   = "Neimenggu"   //内蒙古
 
 	// 日本
 	CITY_TOKYO = "Tokyo" //东京
@@ -111,6 +112,7 @@ const (
 	CITY_US_GOV_WEST    = "us-gov-west"    //???
 	CITY_SOUTH_CAROLINA = "South Carolina" //南卡罗来纳州
 	CITY_SALT_LAKE_CITY = "Salt Lake City" //盐湖城
+	CITY_LAS_VEGAS      = "Las Vegas"      //拉斯维加斯
 
 	// 英国
 	CITY_LONDON      = "London"      //伦敦
@@ -149,6 +151,12 @@ const (
 	// 巴西
 	CITY_SAO_PAULO = "Sao Paulo" //圣保罗
 
+	// 智利
+	CITY_SANTIAGO = "Santiago" // 圣地亚哥
+
+	// 墨西哥
+	CITY_MEXICO = "Mexico" // 墨西哥
+
 	// 荷兰
 	CITY_HOLLAND = "Holland" //荷兰
 
@@ -194,4 +202,6 @@ const (
 	COUNTRY_CODE_VN = "VN" //越南
 	COUNTRY_CODE_CH = "CH" //瑞士
 	COUNTRY_CODE_NO = "NO" //挪威
+	COUNTRY_CODE_MX = "MX" //墨西哥
+	COUNTRY_CODE_CL = "CL" //智利
 )

pkg/apis/compute/dbinstance_account.go

@@ -81,10 +81,13 @@ type DBInstancePrivilege struct {
 
 type DBInstanceAccountDetails struct {
 	apis.StatusStandaloneResourceDetails
+	apis.ProjectizedResourceInfo
 	DBInstanceResourceInfo
 
 	SDBInstanceAccount
 
 	// 账号权限列表
 	DBInstanceprivileges []DBInstancePrivilege `json:"dbinstanceprivileges,allowempty"`
+
+	ProjectId string `json:"tenant_id"`
 }

pkg/apis/compute/dbinstance_database.go

@@ -63,12 +63,14 @@ type DBInstanceDatabaseCreateInput struct {
 
 type DBInstancedatabaseDetails struct {
 	apis.StatusStandaloneResourceDetails
+	apis.ProjectizedResourceInfo
 	DBInstanceResourceInfo
 
 	SDBInstanceDatabase
 
 	// 数据库权限
 	DBInstanceprivileges []DBInstancePrivilege `json:"dbinstanceprivileges"`
+	ProjectId            string                `json:"tenant_id"`
 }
 
 type DBInstanceparameterDetails struct {

pkg/apis/compute/disk_const.go

@@ -55,4 +55,7 @@ const (
 	DISK_BACKING_IMAGE = "image"
 
 	DISK_SIZE_AUTOEXTEND = -1
+
+	DISK_NOT_EXIST = "not_exist"
+	DISK_EXIST     = "exist"
 )

pkg/apis/compute/elasticcache.go

@@ -69,16 +69,20 @@ type ElasticcacheFilterListInput struct {
 
 type ElasticcacheAccountDetails struct {
 	apis.StatusStandaloneResourceDetails
+	apis.ProjectizedResourceInfo
 	ElasticcacheResourceInfo
 
 	SElasticcacheAccount
+	ProjectId string `json:"tenant_id"`
 }
 
 type ElasticcacheAclDetails struct {
 	apis.StandaloneResourceDetails
+	apis.ProjectizedResourceInfo
 	ElasticcacheResourceInfo
 
 	SElasticcacheAcl
+	ProjectId string `json:"tenant_id"`
 }
 
 type ElasticcacheParameterDetails struct {

pkg/apis/compute/elasticcachebackup.go

@@ -18,7 +18,9 @@ import "yunion.io/x/onecloud/pkg/apis"
 
 type ElasticcacheBackupDetails struct {
 	apis.StatusStandaloneResourceDetails
+	apis.ProjectizedResourceInfo
 	ElasticcacheResourceInfo
 
 	SElasticcacheBackup
+	ProjectId string `json:"tenant_id"`
 }

pkg/apis/compute/globalvpc.go

@@ -26,6 +26,9 @@ type GlobalVpcDetails struct {
 	apis.EnabledStatusInfrasResourceBaseDetails
 
 	SGlobalVpc
+
+	// vpc数量
+	VpcCount int `json:"vpc_count"`
 }
 
 type GlobalVpcResourceInfo struct {

pkg/apis/compute/guest_const.go

@@ -135,6 +135,7 @@ const (
 	VM_CONVERT        = "convert"
 	VM_CONVERTING     = "converting"
 	VM_CONVERT_FAILED = "convert_failed"
+	VM_CONVERTED      = "converted"
 
 	SHUTDOWN_STOP      = "stop"
 	SHUTDOWN_TERMINATE = "terminate"

pkg/apis/compute/guestnetwork.go

@@ -20,13 +20,14 @@ type GuestnetworkDetails struct {
 	SGuestnetwork
 
 	// IP子网名称
-	Network string
+	Network string `json:"network"`
 }
 
 type GuestnetworkShortDesc struct {
 	// IP地址
 	IpAddr string `json:"ip_addr"`
 	// 是否为外网网卡
+	// Deprecated
 	IsExit bool `json:"is_exit"`
 	// IPv6地址
 	Ip6Addr string `json:"ip6_addr"`
@@ -34,6 +35,10 @@ type GuestnetworkShortDesc struct {
 	Mac string `json:"mac"`
 	// Bonding的配对网卡MAC
 	TeamWith string `json:"team_with"`
+	// 所属Vpc
+	VpcId string `json:"vpc_id"`
+	// 所属Network
+	NetworkId string `json:"network_id"`
 }
 
 type GuestnetworkListInput struct {

pkg/apis/compute/guests.go

@@ -36,7 +36,7 @@ type ServerListInput struct {
 
 	GroupFilterListInput
 	SecgroupFilterListInput
-	DiskFilterListInput
+	//DiskFilterListInput `"yunion:ambiguous-prefix":"storage_"`
 	ScalingGroupFilterListInput
 
 	// 只列出裸金属主机
@@ -63,6 +63,11 @@ type ServerListInput struct {
 	// 列出可以挂载指定EIP的主机
 	UsableServerForEip string `json:"usable_server_for_eip"`
 
+	// 列出可以挂载磁盘的主机
+	AttachableServersForDisk string `json:"attachable_servers_for_disk"`
+	// Deprecated:列出可以挂载磁盘的主机
+	Disk string `json:"disk" "yunion:deprecated-by":"attachable_servers_for_disk"`
+
 	// 按主机资源类型进行排序
 	// enum: shared,prepaid,dedicated
 	ResourceType string `json:"resource_type"`

pkg/apis/compute/host.go

@@ -143,6 +143,10 @@ type HostDetails struct {
 	CpuCommitRate float64 `json:"cpu_commit_rate"`
 	// 内存超分率
 	MemCommitRate float64 `json:"mem_commit_rate"`
+	// CPU超售比
+	CpuCommitBound float32 `json:"cpu_commit_bound"`
+	// 内存超售比
+	MemCommitBound float32 `json:"mem_commint_bound"`
 	// 存储大小
 	Storage int64 `json:"storage"`
 	// 已使用存储大小
@@ -159,6 +163,8 @@ type HostDetails struct {
 	IsPrepaidRecycle  bool                `json:"is_prepaid_recycle"`
 	CanPrepare        bool                `json:"can_prepare"`
 	PrepareFailReason string              `json:"prepare_fail_reason"`
+	// 允许开启宿主机健康检查
+	AllowHealthCheck bool `json:"allow_health_check"`
 
 	// 标签
 	Metadata map[string]string `json:"metadata"`
@@ -245,19 +251,19 @@ type HostAccessAttributes struct {
 
 type HostSizeAttributes struct {
 	// CPU核数
-	CpuCount int `json:"cpu_count"`
+	CpuCount *int `json:"cpu_count"`
 	// 物理CPU颗数
-	NodeCount int8 `json:"node_count"`
+	NodeCount *int8 `json:"node_count"`
 	// CPU描述信息
 	CpuDesc string `json:"cpu_desc"`
 	// CPU频率
-	CpuMhz int `json:"cpu_mhz"`
+	CpuMhz *int `json:"cpu_mhz"`
 	// CPU缓存大小,单位KB
 	CpuCache string `json:"cpu_cache"`
 	// 预留CPU大小
-	CpuReserved int `json:"cpu_reserved"`
+	CpuReserved *int `json:"cpu_reserved"`
 	// CPU超分比
-	CpuCmtbound float32 `json:"cpu_cmtbound"`
+	CpuCmtbound *float32 `json:"cpu_cmtbound"`
 	// CPUMicrocode
 	CpuMicrocode string `json:"cpu_microcode"`
 	// CPU架构
@@ -268,10 +274,10 @@ type HostSizeAttributes struct {
 	// 预留内存大小(单位MB)
 	MemReserved string `json:"mem_reserved"`
 	// 内存超分比
-	MemCmtbound float32 `json:"mem_cmtbound"`
+	MemCmtbound *float32 `json:"mem_cmtbound"`
 
 	// 存储大小,单位Mb
-	StorageSize int `json:"storage_size"`
+	StorageSize *int `json:"storage_size"`
 	// 存储类型
 	StorageType string `json:"storage_type"`
 	// 存储驱动类型

pkg/apis/compute/host_const.go

@@ -123,3 +123,9 @@ const (
 	BOOT_MODE_PXE = "pxe"
 	BOOT_MODE_ISO = "iso"
 )
+
+const (
+	HOST_HEALTH_PREFIX         = "/onecloud/kvm/host/health"
+	HOST_HEALTH_STATUS_RUNNING = "running"
+	HOST_HEALTH_LOCK_PREFIX    = "host-health"
+)

pkg/apis/compute/isolated_device.go

@@ -54,3 +54,24 @@ type IsolatedDeviceListInput struct {
 	// 设备VENDOE编号
 	VendorDeviceId []string `json:"vendor_device_id"`
 }
+
+type IsolatedDeviceCreateInput struct {
+	apis.StandaloneResourceCreateInput
+
+	HostResourceInput
+
+	// 设备类型USB/GPU
+	// example: GPU
+	DevType string `json:"dev_type"`
+
+	// 设备型号
+	// # Specific device name read from lspci command, e.g. `Tesla K40m` ...
+	Model string `json:"model"`
+
+	// PCI地址
+	// # pci address of `Bus:Device.Function` format, or usb bus address of `bus.addr`
+	Addr string `json:"addr"`
+
+	// 设备VendorId
+	VendorDeviceId string `json:"vendor_device_id"`
+}

pkg/apis/compute/loadbalancer.go

@@ -164,7 +164,11 @@ type LoadbalancerAclListInput struct {
 
 type LoadbalancerDetails struct {
 	apis.VirtualResourceDetails
-	VpcResourceInfo
+
+	ManagedResourceInfo
+	CloudregionResourceInfo
+
+	VpcResourceInfoBase
 	ZoneResourceInfoBase
 	NetworkResourceInfoBase
 

pkg/apis/compute/network.go

@@ -65,16 +65,21 @@ type NetworkFilterListInput struct {
 type NetworkListInput struct {
 	apis.SharableVirtualResourceListInput
 	apis.ExternalizedResourceBaseListInput
+	SchedtagResourceInput
 	WireFilterListInput
 
 	HostResourceInput
 
 	UsableResourceListInput
 
-	// description: search ip address in network.
+	// description: Exact matching ip address in network.
 	// example: 10.168.222.1
 	Ip string `json:"ip"`
 
+	// description: Fuzzy matching ip address in network.
+	// example: 10.168.222.1
+	IpMatch string `json:"ip_match"`
+
 	IfnameHint []string `json:"ifname_hint"`
 	// 起始IP地址
 	GuestIpStart []string `json:"guest_ip_start"`

pkg/apis/compute/scaling_const.go

@@ -56,10 +56,11 @@ const (
 	TIMER_TYPE_MONTH = "month"
 
 	// 加入中 和 加入失败 的不算是 ScalingGroup 的机器
-	SG_GUEST_STATUS_JOINING       = "joining"       // 加入中
-	SG_GUEST_STATUS_READY         = "ready"         // 正常
-	SG_GUEST_STATUS_REMOVING      = "removing"      // 移除中
-	SG_GUEST_STATUS_REMOVE_FAILED = "remove_failed" // 移除失败
+	SG_GUEST_STATUS_JOINING        = "joining"        // 加入中
+	SG_GUEST_STATUS_READY          = "ready"          // 正常
+	SG_GUEST_STATUS_REMOVING       = "removing"       // 移除中
+	SG_GUEST_STATUS_REMOVE_FAILED  = "remove_failed"  // 移除失败
+	SG_GUEST_STATUS_PENDING_REMOVE = "pending_remove" // 机器进入回收站
 
 	// 只有ready状态是正常的
 	SG_STATUS_READY              = "ready"              // 正常

pkg/apis/compute/scaling_policy.go

@@ -17,7 +17,7 @@ package compute
 import "yunion.io/x/onecloud/pkg/apis"
 
 type ScalingPolicyDetails struct {
-	apis.StatusStandaloneResourceDetails
+	apis.VirtualResourceDetails
 	ScalingGroupResourceInfo
 	SScalingPolicy
 	// 定时方式触发
@@ -29,7 +29,7 @@ type ScalingPolicyDetails struct {
 }
 
 type ScalingPolicyCreateInput struct {
-	apis.StandaloneResourceCreateInput
+	apis.VirtualResourceCreateInput
 	apis.EnabledBaseResourceCreateInput
 
 	// description: scaling_group ID or Name
@@ -67,7 +67,7 @@ type ScalingPolicyCreateInput struct {
 }
 
 type ScalingPolicyListInput struct {
-	apis.StatusStandaloneResourceListInput
+	apis.VirtualResourceListInput
 	apis.EnabledResourceBaseListInput
 
 	// description: scaling group

pkg/apis/compute/secgroup.go

@@ -213,3 +213,12 @@ type GuestsecgroupListInput struct {
 	GuestJointsListInput
 	SecgroupFilterListInput
 }
+
+type GuestsecgroupDetails struct {
+	GuestJointResourceDetails
+
+	SGuestsecgroup
+
+	// 安全组名称
+	Secgroup string `json:"secgroup"`
+}

pkg/apis/compute/secgrouprule.go

@@ -18,6 +18,9 @@ import "yunion.io/x/onecloud/pkg/apis"
 
 type SecgroupRuleDetails struct {
 	apis.ResourceBaseDetails
+	apis.ProjectizedResourceInfo
 	SSecurityGroupRule
 	SecurityGroupResourceInfo
+
+	ProjectId string `json:"tenant_id"`
 }

pkg/apis/compute/sku_const.go

@@ -77,6 +77,12 @@ type ServerSkuListInput struct {
 	MemorySizeMb int `json:"memory_size_mb"`
 	// filter sku by CPU core count
 	CpuCoreCount []int `json:"cpu_core_count"`
+
+	// 后付费状态
+	PostpaidStatus string `json:"postpaid_status"`
+
+	// 预付费状态
+	PrepaidStatus string `json:"prepaid_status"`
 }
 
 type ElasticcacheSkuListInput struct {

pkg/apis/compute/snapshot_const.go

@@ -52,4 +52,7 @@ const (
 	SNAPSHOT_POLICY_CACHE_STATUS_READY         = "ready"
 	SNAPSHOT_POLICY_CACHE_STATUS_DELETING      = "deleting"
 	SNAPSHOT_POLICY_CACHE_STATUS_DELETE_FAILED = "delete_failed"
+
+	SNAPSHOT_EXIST     = "exist"
+	SNAPSHOT_NOT_EXIST = "not_exist"
 )

pkg/apis/compute/storage_const.go

@@ -174,6 +174,7 @@ type StorageShareFilterListInput struct {
 type StorageListInput struct {
 	apis.EnabledStatusInfrasResourceBaseListInput
 	apis.ExternalizedResourceBaseListInput
+	SchedtagResourceInput
 
 	ManagedResourceListInput
 	ZonalFilterListInput

pkg/apis/compute/vpcs_ovn.go

@@ -0,0 +1,85 @@
+package compute
+
+import (
+	"yunion.io/x/pkg/util/netutils"
+)
+
+const (
+	sVpcMappedCidr      = "100.64.0.0/17"
+	VpcMappedIPMask     = 17
+	sVpcMappedGatewayIP = "100.64.0.1"
+	VpcMappedGatewayMac = "ee:ee:ee:ee:ee:ee"
+
+	// reserved: [100.64.0.2, 100.64.0.127]
+
+	// [128, 2176 (128+2048)]
+	sVpcMappedHostIPStart = "100.64.0.128"
+	sVpcMappedHostIPEnd   = "100.64.8.128"
+
+	// reserved: [10.64.8.129, 10.64.8.255]
+
+	// [2304, 32511], 30207
+	sVpcMappedIPStart = "100.64.9.0"
+	sVpcMappedIPEnd   = "100.64.126.255"
+
+	// reserved: [10.64.127.0 , 10.64.127.255]
+)
+
+var (
+	vpcMappedCidr      netutils.IPV4Prefix
+	vpcMappedGatewayIP netutils.IPV4Addr
+
+	vpcMappedHostIPStart netutils.IPV4Addr
+	vpcMappedHostIPEnd   netutils.IPV4Addr
+
+	vpcMappedIPStart netutils.IPV4Addr
+	vpcMappedIPEnd   netutils.IPV4Addr
+)
+
+func init() {
+	mi := func(v netutils.IPV4Addr, err error) netutils.IPV4Addr {
+		if err != nil {
+			panic(err.Error())
+		}
+		return v
+	}
+	mp := func(v netutils.IPV4Prefix, err error) netutils.IPV4Prefix {
+		if err != nil {
+			panic(err.Error())
+		}
+		return v
+	}
+
+	vpcMappedCidr = mp(netutils.NewIPV4Prefix(sVpcMappedCidr))
+	vpcMappedGatewayIP = mi(netutils.NewIPV4Addr(sVpcMappedGatewayIP))
+
+	vpcMappedHostIPStart = mi(netutils.NewIPV4Addr(sVpcMappedHostIPStart))
+	vpcMappedHostIPEnd = mi(netutils.NewIPV4Addr(sVpcMappedHostIPEnd))
+
+	vpcMappedIPStart = mi(netutils.NewIPV4Addr(sVpcMappedIPStart))
+	vpcMappedIPEnd = mi(netutils.NewIPV4Addr(sVpcMappedIPEnd))
+}
+
+func VpcMappedCidr() netutils.IPV4Prefix {
+	return vpcMappedCidr
+}
+
+func VpcMappedGatewayIP() netutils.IPV4Addr {
+	return vpcMappedGatewayIP
+}
+
+func VpcMappedHostIPStart() netutils.IPV4Addr {
+	return vpcMappedHostIPStart
+}
+
+func VpcMappedHostIPEnd() netutils.IPV4Addr {
+	return vpcMappedHostIPEnd
+}
+
+func VpcMappedIPStart() netutils.IPV4Addr {
+	return vpcMappedIPStart
+}
+
+func VpcMappedIPEnd() netutils.IPV4Addr {
+	return vpcMappedIPEnd
+}

pkg/apis/compute/wire.go

@@ -71,11 +71,11 @@ type WireUpdateInput struct {
 	apis.InfrasResourceBaseUpdateInput
 
 	// bandwidth in MB
-	Bandwidth int `json:"bandwidth"`
+	Bandwidth *int `json:"bandwidth"`
 
 	// MTU
 	// example: 1500
-	Mtu int `json:"mtu"`
+	Mtu *int `json:"mtu"`
 }
 
 type WireListInput struct {

pkg/apis/compute/zz_generated.model.go

@@ -1297,17 +1297,7 @@ type SLoadbalancerBackendgroupResourceBase struct {
 type SLoadbalancerCertificate struct {
 	apis.SVirtualResourceBase
 	apis.SExternalizedResourceBase
-	Certificate string `json:"certificate"`
-	PrivateKey  string `json:"private_key"`
-	// derived attributes
-	PublicKeyAlgorithm      string    `json:"public_key_algorithm"`
-	PublicKeyBitLen         int       `json:"public_key_bit_len"`
-	SignatureAlgorithm      string    `json:"signature_algorithm"`
-	Fingerprint             string    `json:"fingerprint"`
-	NotBefore               time.Time `json:"not_before"`
-	NotAfter                time.Time `json:"not_after"`
-	CommonName              string    `json:"common_name"`
-	SubjectAlternativeNames string    `json:"subject_alternative_names"`
+	apis.SCertificateResourceBase
 }
 
 // SLoadbalancerCertificateResourceBase is an autogenerated struct via yunion.io/x/onecloud/pkg/compute/models.SLoadbalancerCertificateResourceBase.
@@ -1747,7 +1737,7 @@ type SScalingGroupResourceBase struct {
 
 // SScalingPolicy is an autogenerated struct via yunion.io/x/onecloud/pkg/compute/models.SScalingPolicy.
 type SScalingPolicy struct {
-	apis.SStatusStandaloneResourceBase
+	apis.SVirtualResourceBase
 	SScalingGroupResourceBase
 	apis.SEnabledResourceBase
 	TriggerType string `json:"trigger_type"`

pkg/apis/identity/assignments.go

@@ -62,3 +62,7 @@ func (ra *SRoleAssignment) GetRoles() []string {
 func (ra *SRoleAssignment) GetLoginIp() string {
 	return ""
 }
+
+func (ra *SRoleAssignment) GetTokenString() string {
+	return "faketoken"
+}

pkg/apis/identity/consts.go

@@ -102,6 +102,9 @@ var (
 
 	ServiceBlacklistOptionMap = map[string][]string{
 		"default": []string{
+			// ############################
+			// common blacklist options
+			// ############################
 			"help",
 			"version",
 			"config",
@@ -120,7 +123,9 @@ var (
 			"session_endpoint_type",
 			"admin_password",
 			"admin_project",
+			"admin_project_domain",
 			"admin_user",
+			"admin_domain",
 			"auth_url",
 			"enable_ssl",
 			"ssl_certfile",
@@ -130,6 +135,9 @@ var (
 			"is_slave_node",
 			"config_sync_period_seconds",
 
+			// ############################
+			// db blacklist options
+			// ############################
 			"sql_connection",
 			"auto_sync_table",
 			"exit_after_db_init",
@@ -146,6 +154,43 @@ var (
 			"etcd_cacert",
 			"etcd_cert",
 			"etcd_key",
+
+			// ############################
+			// keystone blacklist options
+			// ############################
+			"bootstrap_admin_user_password",
+			"reset_admin_user_password",
+			"fernet_key_repository",
+
+			// ############################
+			// baremetal blacklist options
+			// ############################
+			"listen_interface",
+			"access_address",
+			"listen_address",
+			"tftp_root",
+			// "AutoRegisterBaremetal",
+			"baremetals_path",
+			// "LinuxDefaultRootUser",
+			"ipmi_lan_port_shared",
+			"zone",
+			"dhcp_lease_time",
+			"dhcp_renewal_time",
+			"enable_general_guest_dhcp",
+			"force_dhcp_probe_ipmi",
+			"tftp_block_size_in_bytes",
+			"tftp_max_timeout_retries",
+			"lengthy_worker_count",
+			"short_worker_count",
+			// "default_ipmi_password",
+			// "default_strong_ipmi_password",
+			// "windows_default_admin_user",
+			"cache_path",
+			"enable_pxe_boot",
+			"boot_iso_path",
+			// "status_probe_interval_seconds",
+			// "log_fetch_interval_seconds",
+			// "send_metrics_interval_seconds",
 		},
 	}
 )

pkg/apis/identity/endpoint.go

@@ -19,6 +19,7 @@ import "yunion.io/x/onecloud/pkg/apis"
 type EndpointDetails struct {
 	apis.StandaloneResourceDetails
 	SEndpoint
+	CertificateDetails
 
 	// 服务名称,例如keystone, glance, region等
 	ServiceName string `json:"service_name"`
@@ -26,3 +27,16 @@ type EndpointDetails struct {
 	// 服务类型,例如identity, image, compute等
 	ServiceType string `json:"service_type"`
 }
+
+type CertificateDetails struct {
+	apis.SCertificateResourceBase
+	CertName string `json:"cert_name"`
+	CertId   string `json:"cert_id"`
+
+	CaCertificate string `json:"ca_certificate"`
+	CaPrivateKey  string `json:"ca_private_key"`
+}
+
+const (
+	ENDPOINT_ETCD_INTERNAL = "etcd-internal"
+)

pkg/apis/identity/identityprovider.go

@@ -42,6 +42,8 @@ type IdentityProviderDetails struct {
 
 	// 该认证源关联的所有域的组数量
 	GroupCount int `json:"group_count,allowempty"`
+
+	SIdentityProvider
 }
 
 type IdpResourceInfo struct {

pkg/apis/identity/input.go

@@ -23,6 +23,7 @@ import (
 
 type IdentityBaseResourceCreateInput struct {
 	apis.StandaloneResourceCreateInput
+	apis.DomainizedResourceCreateInput
 }
 
 type EnabledIdentityBaseResourceCreateInput struct {
@@ -193,8 +194,8 @@ type EndpointListInput struct {
 }
 
 type SJoinProjectsInput struct {
-	Projects []string
-	Roles    []string
+	Projects []string `json:"projects"`
+	Roles    []string `json:"roles"`
 }
 
 func (input SJoinProjectsInput) Validate() error {
@@ -208,11 +209,12 @@ func (input SJoinProjectsInput) Validate() error {
 }
 
 type SProjectRole struct {
-	Project string
-	Role    string
+	Project string `json:"project"`
+	Role    string `json:"role"`
 }
+
 type SLeaveProjectsInput struct {
-	ProjectRoles []SProjectRole
+	ProjectRoles []SProjectRole `json:"project_roles"`
 }
 
 func (input SLeaveProjectsInput) Validate() error {
@@ -450,3 +452,13 @@ type RoleCreateInput struct {
 
 	apis.SharableResourceBaseCreateInput
 }
+
+type PerformGroupAddUsersInput struct {
+	// 带添加用户列表（ID或名称）
+	User []string `json:"user"`
+}
+
+type PerformGroupRemoveUsersInput struct {
+	// 带删除用户列表（ID或名称）
+	User []string `json:"user"`
+}

pkg/apis/identity/zz_generated.model.go

@@ -55,12 +55,11 @@ type SCredential struct {
 // SDomain is an autogenerated struct via yunion.io/x/onecloud/pkg/keystone/models.SDomain.
 type SDomain struct {
 	apis.SStandaloneResourceBase
-	Extra       interface{} `json:"extra"`
-	Enabled     *bool       `json:"enabled,omitempty"`
-	IsDomain    *bool       `json:"is_domain,omitempty"`
-	DomainId    string      `json:"domain_id"`
-	ParentId    string      `json:"parent_id"`
-	Displayname string      `json:"displayname"`
+	Extra    interface{} `json:"extra"`
+	Enabled  *bool       `json:"enabled,omitempty"`
+	IsDomain *bool       `json:"is_domain,omitempty"`
+	DomainId string      `json:"domain_id"`
+	ParentId string      `json:"parent_id"`
 }
 
 // SEnabledIdentityBaseResource is an autogenerated struct via yunion.io/x/onecloud/pkg/keystone/models.SEnabledIdentityBaseResource.
@@ -72,13 +71,14 @@ type SEnabledIdentityBaseResource struct {
 // SEndpoint is an autogenerated struct via yunion.io/x/onecloud/pkg/keystone/models.SEndpoint.
 type SEndpoint struct {
 	apis.SStandaloneResourceBase
-	LegacyEndpointId string      `json:"legacy_endpoint_id"`
-	Interface        string      `json:"interface"`
-	ServiceId        string      `json:"service_id"`
-	Url              string      `json:"url"`
-	Extra            interface{} `json:"extra"`
-	Enabled          *bool       `json:"enabled,omitempty"`
-	RegionId         string      `json:"region_id"`
+	LegacyEndpointId     string      `json:"legacy_endpoint_id"`
+	Interface            string      `json:"interface"`
+	ServiceId            string      `json:"service_id"`
+	Url                  string      `json:"url"`
+	Extra                interface{} `json:"extra"`
+	Enabled              *bool       `json:"enabled,omitempty"`
+	RegionId             string      `json:"region_id"`
+	ServiceCertificateId string      `json:"service_certificate_id"`
 }
 
 // SFederatedUser is an autogenerated struct via yunion.io/x/onecloud/pkg/keystone/models.SFederatedUser.
@@ -164,9 +164,8 @@ type SPolicy struct {
 // SProject is an autogenerated struct via yunion.io/x/onecloud/pkg/keystone/models.SProject.
 type SProject struct {
 	SIdentityBaseResource
-	ParentId    string `json:"parent_id"`
-	IsDomain    *bool  `json:"is_domain,omitempty"`
-	Displayname string `json:"displayname"`
+	ParentId string `json:"parent_id"`
+	IsDomain *bool  `json:"is_domain,omitempty"`
 }
 
 // SRegion is an autogenerated struct via yunion.io/x/onecloud/pkg/keystone/models.SRegion.
@@ -190,6 +189,14 @@ type SService struct {
 	Extra   interface{} `json:"extra"`
 }
 
+// SServiceCertificate is an autogenerated struct via yunion.io/x/onecloud/pkg/keystone/models.SServiceCertificate.
+type SServiceCertificate struct {
+	apis.SStandaloneResourceBase
+	apis.SCertificateResourceBase
+	CaCertificate string `json:"ca_certificate"`
+	CaPrivateKey  string `json:"ca_private_key"`
+}
+
 // SUser is an autogenerated struct via yunion.io/x/onecloud/pkg/keystone/models.SUser.
 type SUser struct {
 	SEnabledIdentityBaseResource

pkg/apis/image/guestimage.go

@@ -26,7 +26,7 @@ type GuestImageDetails struct {
 	apis.SharableVirtualResourceDetails
 	SGuestImage
 
-	ImageIds jsonutils.JSONObject `json:"image_ids"`
+	ImageIds []string `json:"image_ids"`
 
 	//Status     string               `json:"status"`
 	Size       int64          `json:"size"`

pkg/apis/image/image.go

@@ -28,6 +28,9 @@ type ImageListInput struct {
 	// 列出是否支持UEFI启动的镜像
 	Uefi *bool `json:"uefi"`
 
+	// 根据已转换格式过滤, 可能值为: qcow2, vmdk, vhd, raw等
+	SubFormats []string `json:"subFormats"`
+
 	// 是否为标准镜像
 	IsStandard *bool `json:"is_standard"`
 
@@ -61,3 +64,27 @@ type ImageDetails struct {
 	DisableDelete bool `json:"disable_delete"`
 	//OssChecksum   string    `json:"oss_checksum"`
 }
+
+type ImageCreateInput struct {
+	apis.SharableVirtualResourceCreateInput
+
+	// 镜像大小, 单位Byte
+	Size *int64 `json:"size"`
+	// 镜像格式
+	DiskFormat string `json:"disk_format"`
+	// 最小系统盘要求
+	MinDiskMB *int32 `json:"min_disk"`
+	// 最小内存要求
+	MinRamMB *int32 `json:"min_ram"`
+	// 是否有删除保护
+	Protected *bool `json:"protected"`
+	// 是否是标准镜像
+	IsStandard *bool `json:"is_standard"`
+	// 是否是主机镜像
+	IsGuestImage *bool `json:"is_guest_image"`
+	// 是否是数据盘镜像
+	IsData *bool `json:"is_data"`
+
+	// 镜像属性
+	Properties map[string]string `json:"properties"`
+}

pkg/apis/input.go

@@ -180,18 +180,22 @@ type GetDetailsStatusOutput struct {
 	Status string `json:"status"`
 }
 
-type PerformPublicInput struct {
+type PerformPublicDomainInput struct {
 	// 共享项目资源的共享范围，可能的值为：project, domain和system
 	// pattern: project|domain|system
 	Scope string `json:"scope"`
 
-	// 如果共享范围为项目，则在此列表中指定共享的目标项目
-	SharedProjects []string `json:"shared_projects"`
-
 	// 如果共享范围为域，则在此列表中指定共享的目标域
 	SharedDomains []string `json:"shared_domains"`
 }
 
+type PerformPublicProjectInput struct {
+	PerformPublicDomainInput
+
+	// 如果共享范围为项目，则在此列表中指定共享的目标项目
+	SharedProjects []string `json:"shared_projects"`
+}
+
 type PerformPrivateInput struct {
 }
 
@@ -209,6 +213,11 @@ type PerformEnableInput struct {
 type PerformDisableInput struct {
 }
 
+type StorageForceDetachHostInput struct {
+	// Host id or name
+	Host string `json:"host"`
+}
+
 type InfrasResourceBaseCreateInput struct {
 	DomainLevelResourceCreateInput
 
@@ -224,3 +233,54 @@ type EnabledStatusInfrasResourceBaseCreateInput struct {
 	StatusInfrasResourceBaseCreateInput
 	EnabledBaseResourceCreateInput
 }
+
+type OpsLogCreateInput struct {
+	ModelBaseCreateInput
+
+	ObjType string `json:"obj_type"`
+	ObjId   string `json:"obj_id"`
+	ObjName string `json:"obj_name"`
+	Action  string `json:"action"`
+	Notes   string `json:"notes"`
+
+	ProjectId string `json:"tenant_id"`
+	Project   string `json:"tenant"`
+
+	ProjectDomainId string `json:"project_domain_id"`
+	ProjectDomain   string `json:"project_domain"`
+
+	UserId   string `json:"user_id"`
+	User     string `json:"user"`
+	DomainId string `json:"domain_id"`
+	Domain   string `json:"domain"`
+	Roles    string `json:"roles"`
+
+	OwnerDomainId  string `json:"owner_domain_id"`
+	OwnerProjectId string `json:"owner_tenant_id"`
+}
+
+// 设置资源的标签（元数据）输入
+type PerformMetadataInput map[string]string
+
+// 设置资源的用户标签（元数据）输入
+type PerformUserMetadataInput map[string]string
+
+// 全量替换资源的用户标签（元数据）输入
+type PerformSetUserMetadataInput map[string]string
+
+// 获取资源的元数据输入
+type GetMetadataInput struct {
+	// 指定需要获取的所有标签的KEY列表，如果列表为空，则获取全部标签
+	// 标签分为
+	//
+	// | 类型     | 说明                                        |
+	// |----------|---------------------------------------------|
+	// | 系统标签 | 平台定义的标签                              |
+	// | 用户标签 | key以user:为前缀，用户自定义标签            |
+	// | 外部标签 | key以ext:为前缀，为从其他平台同步过来的标签 |
+	//
+	Field []string `json:"field"`
+}
+
+// 获取资源标签（元数据）输出
+type GetMetadataOutput map[string]string

pkg/apis/monitor/suggestsys_const.go

@@ -14,14 +14,22 @@
 
 package monitor
 
+const (
+	SUGGEST_ALERT_READY        = "ready"
+	SUGGEST_ALERT_START_DELETE = "start_delete"
+	SUGGEST_ALERT_DELETE_FAIL  = "delete_fail"
+	SUGGEST_ALERT_DELETING     = "deleting"
+)
+
 const (
 	EIP_UN_USED  = "EIP_UNUSED"
 	DISK_UN_USED = "DISK_UNUSED"
+	LB_UN_USED   = "LB_UNUSED"
+	SCALE_DOWN   = "SCALE_DOWN"
+	SCALE_UP     = "SCALE_UP"
 
-	DRIVER_ACTION = "DELETE"
-
-	EIP_UNUSED_START_DELETE = "start_delete"
-	EIP_UNUSED_DELETE_FAIL  = "delete_fail"
+	DRIVER_ACTION            = "DELETE"
+	SCALE_DOWN_DRIVER_ACTION = "SCALE_DOWN"
 )
 
 type MonitorSuggest string
@@ -29,11 +37,21 @@ type MonitorSuggest string
 type MonitorResourceType string
 
 const (
-	EIP_MONITOR_RES_TYPE  = MonitorResourceType("弹性EIP")
-	DISK_MONITOR_RES_TYPE = MonitorResourceType("云硬盘")
+	EIP_MONITOR_RES_TYPE    = MonitorResourceType("弹性EIP")
+	DISK_MONITOR_RES_TYPE   = MonitorResourceType("云硬盘")
+	LB_MONITOR_RES_TYPE     = MonitorResourceType("负载均衡实例")
+	SCALE_MONTITOR_RES_TYPE = MonitorResourceType("虚拟机")
 )
 
 const (
-	EIP_MONITOR_SUGGEST  = MonitorSuggest("释放未使用的EIP")
-	DISK_MONITOR_SUGGEST = MonitorSuggest("释放未使用的Disk")
+	EIP_MONITOR_SUGGEST        = MonitorSuggest("释放未使用的EIP")
+	DISK_MONITOR_SUGGEST       = MonitorSuggest("释放未使用的Disk")
+	LB_MONITOR_SUGGEST         = MonitorSuggest("释放未使用的LB")
+	SCALE_DOWN_MONITOR_SUGGEST = MonitorSuggest("缩减机器配置")
+)
+
+const (
+	LB_UNUSED_NLISTENER = "没有监听"
+	LB_UNUSED_NBCGROUP  = "没有后端服务器组"
+	LB_UNUSED_NBC       = "没有后端服务器"
 )

pkg/apis/monitor/suggestsysalert.go

@@ -51,6 +51,7 @@ type SuggestSysAlertDetails struct {
 	apis.VirtualResourceDetails
 	compute.CloudregionResourceInfo
 	RuleName string `json:"rule_name"`
+	ShowName string `json:"show_name"`
 	ResType  string `json:"res_type"`
 	Suggest  string `json:"suggest"`
 	Brand    string `json:"brand"`

pkg/apis/monitor/suggestsysrule.go

@@ -20,6 +20,25 @@ import (
 	"yunion.io/x/onecloud/pkg/apis"
 )
 
+const (
+	METRIC_TAG   = "TAG"
+	METRIC_FIELD = "FIELD"
+)
+
+var PROPERTY_TYPE = []string{"databases", "measurements", "metric-measurement"}
+
+var METRIC_ATTRI = []string{METRIC_TAG, METRIC_FIELD}
+
+type InfluxMeasurement struct {
+	apis.Meta
+	Database    string
+	Measurement string
+	TagKey      []string
+	TagValue    map[string][]string
+	FieldKey    []string
+	Unit        []string
+}
+
 type SuggestSysRuleListInput struct {
 	apis.VirtualResourceListInput
 	apis.EnabledResourceBaseListInput
@@ -29,10 +48,11 @@ type SuggestSysRuleCreateInput struct {
 	apis.VirtualResourceCreateInput
 
 	// 查询指标周期
-	Period  string                   `json:"period"`
-	Type    string                   `json:"type"`
-	Enabled *bool                    `json:"enabled"`
-	Setting *SSuggestSysAlertSetting `json:"setting"`
+	Period   string                   `json:"period"`
+	TimeFrom string                   `json:"time_from"`
+	Type     string                   `json:"type"`
+	Enabled  *bool                    `json:"enabled"`
+	Setting  *SSuggestSysAlertSetting `json:"setting"`
 }
 
 type SuggestSysRuleUpdateInput struct {
@@ -59,6 +79,8 @@ type SuggestSysRuleDetails struct {
 type SSuggestSysAlertSetting struct {
 	EIPUnused  *EIPUnused  `json:"eip_unused"`
 	DiskUnused *DiskUnused `json:"disk_unused"`
+	LBUnused   *LBUnused   `json:"lb_unused"`
+	ScaleRule  *ScaleRule  `json:"scale_rule"`
 }
 
 type EIPUnused struct {
@@ -67,3 +89,25 @@ type EIPUnused struct {
 
 type DiskUnused struct {
 }
+
+type LBUnused struct {
+}
+
+type ScaleRule []Scale
+
+type Scale struct {
+	Database    string `json:"database"`
+	Measurement string `json:"measurement"`
+	//rule operator rule [and|or]
+	Operator  string  `json:"operator"`
+	Field     string  `json:"field"`
+	EvalType  string  `json:"eval_type"`
+	Threshold float64 `json:"threshold"`
+	Tag       string  `json:"tag"`
+	TagVal    string  `json:"tag_val"`
+}
+
+type ScaleEvalMatch struct {
+	EvalMatch
+	ResourceId map[string]string `json:"resource_id"`
+}

pkg/apis/monitor/zz_generated.model.go

@@ -88,14 +88,19 @@ type SSuggestSysAlert struct {
 	apis.SVirtualResourceBase
 	apis.SEnabledResourceBase
 	// 监控规则对应的json对象
+	RuleName      string      `json:"rule_name"`
 	MonitorConfig interface{} `json:"monitor_config"`
 	// 监控规则type：Rule Type
 	Type    string      `json:"type"`
 	ResMeta interface{} `json:"res_meta"`
 	Problem interface{} `json:"problem"`
-	Suggest string      `json:"suggest"`
-	Action  string      `json:"action"`
-	ResId   string      `json:"res_id"`
+	// Suggest string               `width:"256"  list:"user" update:"user"`
+	Action       string `json:"action"`
+	ResId        string `json:"res_id"`
+	CloudEnv     string `json:"cloud_env"`
+	Provider     string `json:"provider"`
+	Project      string `json:"project"`
+	Cloudaccount string `json:"cloudaccount"`
 }
 
 // SSuggestSysRule is an autogenerated struct via yunion.io/x/onecloud/pkg/monitor/models.SSuggestSysRule.

pkg/apis/notify/notification.go

@@ -25,3 +25,8 @@ type NotificationDetails struct {
 
 	UserList jsonutils.JSONObject `json:"user_list"`
 }
+
+type NotificationListInput struct {
+	Scope       string `json:"scope"`
+	ContactType string `json:"contact_type"`
+}

pkg/apis/output.go

@@ -14,6 +14,10 @@
 
 package apis
 
+import (
+	"time"
+)
+
 type ModelBaseDetails struct {
 	Meta
 
@@ -28,7 +32,7 @@ type ModelBaseDetails struct {
 	// example: true
 	CanUpdate bool `json:"can_update"`
 
-	// 资源不能删除的原因
+	// 资源不能更新的原因
 	UpdateFailReason string `json:"update_fail_reason"`
 }
 
@@ -160,3 +164,34 @@ type EnabledStatusInfrasResourceBaseDetails struct {
 type ChangeOwnerCandidateDomainsOutput struct {
 	Candidates []SharedDomain `json:"candidates"`
 }
+
+type OpsLogDetails struct {
+	ModelBaseDetails
+
+	Id      int64  `json:"id"`
+	ObjType string `json:"obj_type"`
+	ObjId   string `json:"obj_id"`
+	ObjName string `json:"obj_name"`
+	Action  string `json:"action"`
+	Notes   string `json:"notes"`
+
+	ProjectId string `json:"tenant_id"`
+	Project   string `json:"tenant"`
+
+	ProjectDomainId string `json:"project_domain_id"`
+	ProjectDomain   string `json:"project_domain"`
+
+	UserId   string `json:"user_id"`
+	User     string `json:"user"`
+	DomainId string `json:"domain_id"`
+	Domain   string `json:"domain"`
+	Roles    string `json:"roles"`
+
+	OpsTime time.Time `json:"ops_time"`
+
+	OwnerDomainId  string `json:"owner_domain_id"`
+	OwnerProjectId string `json:"owner_project_id"`
+
+	OwnerDomain  string `json:"owner_domain"`
+	OwnerProject string `json:"owner_tenant"`
+}

pkg/apis/share.go

@@ -14,7 +14,16 @@
 
 package apis
 
-import "yunion.io/x/onecloud/pkg/util/rbacutils"
+import (
+	"yunion.io/x/onecloud/pkg/util/rbacutils"
+	"yunion.io/x/onecloud/pkg/util/stringutils2"
+)
+
+const (
+	CLOUD_ACCOUNT_SHARE_MODE_ACCOUNT_DOMAIN  = "account_domain"
+	CLOUD_ACCOUNT_SHARE_MODE_SYSTEM          = "system"
+	CLOUD_ACCOUNT_SHARE_MODE_PROVIDER_DOMAIN = "provider_domain"
+)
 
 type SAccountShareInfo struct {
 	IsPublic      bool
@@ -22,3 +31,139 @@ type SAccountShareInfo struct {
 	ShareMode     string
 	SharedDomains []string
 }
+
+type SShareInfo struct {
+	IsPublic       bool
+	PublicScope    rbacutils.TRbacScope
+	SharedDomains  []string
+	SharedProjects []string
+}
+
+func (i SAccountShareInfo) GetProjectShareInfo() SShareInfo {
+	ret := SShareInfo{}
+	switch i.ShareMode {
+	case CLOUD_ACCOUNT_SHARE_MODE_ACCOUNT_DOMAIN:
+		ret.IsPublic = true
+		ret.PublicScope = rbacutils.ScopeDomain
+	case CLOUD_ACCOUNT_SHARE_MODE_PROVIDER_DOMAIN:
+		ret.IsPublic = true
+		ret.PublicScope = rbacutils.ScopeDomain
+	case CLOUD_ACCOUNT_SHARE_MODE_SYSTEM:
+		ret.IsPublic = true
+		if i.IsPublic && i.PublicScope == rbacutils.ScopeSystem {
+			ret.PublicScope = rbacutils.ScopeSystem
+		} else {
+			ret.PublicScope = rbacutils.ScopeDomain
+			ret.SharedDomains = i.SharedDomains
+		}
+	}
+	return ret
+}
+
+func (i SAccountShareInfo) GetDomainShareInfo() SShareInfo {
+	ret := SShareInfo{}
+	switch i.ShareMode {
+	case CLOUD_ACCOUNT_SHARE_MODE_ACCOUNT_DOMAIN:
+		ret.IsPublic = false
+		ret.PublicScope = rbacutils.ScopeNone
+	case CLOUD_ACCOUNT_SHARE_MODE_PROVIDER_DOMAIN:
+		ret.IsPublic = false
+		ret.PublicScope = rbacutils.ScopeNone
+	case CLOUD_ACCOUNT_SHARE_MODE_SYSTEM:
+		if i.IsPublic && i.PublicScope == rbacutils.ScopeSystem {
+			ret.IsPublic = true
+			ret.PublicScope = rbacutils.ScopeSystem
+		} else if len(i.SharedDomains) > 0 {
+			ret.IsPublic = true
+			ret.PublicScope = rbacutils.ScopeDomain
+			ret.SharedDomains = i.SharedDomains
+		} else {
+			ret.IsPublic = false
+			ret.PublicScope = rbacutils.ScopeNone
+		}
+	}
+	return ret
+}
+
+func (i SShareInfo) IsViolate(i2 SShareInfo) bool {
+	if i.IsPublic && !i2.IsPublic {
+		return true
+	} else if !i.IsPublic && i2.IsPublic {
+		return false
+	}
+	// is_public equals
+	if i.PublicScope.HigherThan(i2.PublicScope) {
+		return true
+	} else if i2.PublicScope.HigherThan(i.PublicScope) {
+		return false
+	}
+	// public_scope equals
+	aNoB, _, bNoA := stringutils2.Split(stringutils2.NewSortedStrings(i.SharedDomains), stringutils2.NewSortedStrings(i2.SharedDomains))
+	if len(aNoB) > 0 {
+		return true
+	} else if len(bNoA) > 0 {
+		return false
+	}
+	// shared_domains equals
+	aNoB, _, bNoA = stringutils2.Split(stringutils2.NewSortedStrings(i.SharedProjects), stringutils2.NewSortedStrings(i2.SharedProjects))
+	if len(aNoB) > 0 {
+		return true
+	} else if len(bNoA) > 0 {
+		return false
+	}
+	return false
+}
+
+func (i SShareInfo) Intersect(i2 SShareInfo) SShareInfo {
+	if i.IsPublic && !i2.IsPublic {
+		return i2
+	} else if !i.IsPublic && i2.IsPublic {
+		return i
+	}
+	// is_public equals
+	if i.PublicScope.HigherThan(i2.PublicScope) {
+		return i2
+	} else if i2.PublicScope.HigherThan(i.PublicScope) {
+		return i
+	}
+	// public_scope equals
+	_, domains, _ := stringutils2.Split(stringutils2.NewSortedStrings(i.SharedDomains), stringutils2.NewSortedStrings(i2.SharedDomains))
+	_, projs, _ := stringutils2.Split(stringutils2.NewSortedStrings(i.SharedProjects), stringutils2.NewSortedStrings(i2.SharedProjects))
+	ret := SShareInfo{
+		IsPublic:       i.IsPublic,
+		PublicScope:    i.PublicScope,
+		SharedDomains:  domains,
+		SharedProjects: projs,
+	}
+	if ret.PublicScope == rbacutils.ScopeProject && len(ret.SharedProjects) == 0 {
+		ret.IsPublic = false
+		ret.PublicScope = rbacutils.ScopeNone
+	}
+	return ret
+}
+
+func (i SShareInfo) Equals(i2 SShareInfo) bool {
+	if !i.IsViolate(i2) && !i2.IsViolate(i) {
+		return true
+	} else {
+		return false
+	}
+}
+
+func (i *SShareInfo) FixProjectShare() {
+	if i.PublicScope == rbacutils.ScopeProject && len(i.SharedProjects) == 0 {
+		i.IsPublic = false
+		i.PublicScope = rbacutils.ScopeNone
+	}
+}
+
+func (i *SShareInfo) FixDomainShare() {
+	if i.PublicScope == rbacutils.ScopeProject {
+		i.IsPublic = false
+		i.PublicScope = rbacutils.ScopeNone
+		i.SharedProjects = nil
+	} else if i.PublicScope == rbacutils.ScopeDomain && len(i.SharedDomains) == 0 {
+		i.IsPublic = false
+		i.PublicScope = rbacutils.ScopeNone
+	}
+}

pkg/apis/share_test.go

@@ -0,0 +1,199 @@
+// Copyright 2019 Yunion
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//     http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
+package apis
+
+import (
+	"testing"
+
+	"yunion.io/x/onecloud/pkg/util/rbacutils"
+)
+
+func TestSShareInfo_IsViolate(t *testing.T) {
+	cases := []struct {
+		name     string
+		s1       SShareInfo
+		s2       SShareInfo
+		violate1 bool
+		violate2 bool
+	}{
+		{
+			name: "case1",
+			s1: SShareInfo{
+				IsPublic:    false,
+				PublicScope: rbacutils.ScopeNone,
+			},
+			s2: SShareInfo{
+				IsPublic:    true,
+				PublicScope: rbacutils.ScopeSystem,
+			},
+			violate1: false,
+			violate2: true,
+		},
+		{
+			name: "case2",
+			s1: SShareInfo{
+				IsPublic:       true,
+				PublicScope:    rbacutils.ScopeProject,
+				SharedProjects: []string{"p1"},
+			},
+			s2: SShareInfo{
+				IsPublic:       true,
+				PublicScope:    rbacutils.ScopeProject,
+				SharedProjects: []string{"p2"},
+			},
+			violate1: true,
+			violate2: true,
+		},
+		{
+			name: "case3",
+			s1: SShareInfo{
+				IsPublic:      true,
+				PublicScope:   rbacutils.ScopeDomain,
+				SharedDomains: []string{"p1"},
+			},
+			s2: SShareInfo{
+				IsPublic:       true,
+				PublicScope:    rbacutils.ScopeProject,
+				SharedProjects: []string{"p2"},
+			},
+			violate1: true,
+			violate2: false,
+		},
+		{
+			name: "case4",
+			s1: SShareInfo{
+				IsPublic:      true,
+				PublicScope:   rbacutils.ScopeDomain,
+				SharedDomains: []string{"p1", "p2"},
+			},
+			s2: SShareInfo{
+				IsPublic:      true,
+				PublicScope:   rbacutils.ScopeDomain,
+				SharedDomains: []string{"p1", "p2"},
+			},
+			violate1: false,
+			violate2: false,
+		},
+	}
+	for _, c := range cases {
+		if c.s1.IsViolate(c.s2) != c.violate1 {
+			t.Errorf("[%s] s1.violate(s2) want %v", c.name, c.violate1)
+		} else if c.s2.IsViolate(c.s1) != c.violate2 {
+			t.Errorf("[%s] s2.violate(s1) want: %v", c.name, c.violate2)
+		}
+	}
+}
+
+func TestSShareInfo_Intersect(t *testing.T) {
+	cases := []struct {
+		name string
+		s1   SShareInfo
+		s2   SShareInfo
+		want SShareInfo
+	}{
+		{
+			name: "case1",
+			s1: SShareInfo{
+				IsPublic:    false,
+				PublicScope: rbacutils.ScopeNone,
+			},
+			s2: SShareInfo{
+				IsPublic:    true,
+				PublicScope: rbacutils.ScopeSystem,
+			},
+			want: SShareInfo{
+				IsPublic:    false,
+				PublicScope: rbacutils.ScopeNone,
+			},
+		},
+		{
+			name: "case2",
+			s1: SShareInfo{
+				IsPublic:       true,
+				PublicScope:    rbacutils.ScopeProject,
+				SharedProjects: []string{"p1"},
+			},
+			s2: SShareInfo{
+				IsPublic:       true,
+				PublicScope:    rbacutils.ScopeProject,
+				SharedProjects: []string{"p2"},
+			},
+			want: SShareInfo{
+				IsPublic:    false,
+				PublicScope: rbacutils.ScopeNone,
+			},
+		},
+		{
+			name: "case3",
+			s1: SShareInfo{
+				IsPublic:      true,
+				PublicScope:   rbacutils.ScopeDomain,
+				SharedDomains: []string{"p1"},
+			},
+			s2: SShareInfo{
+				IsPublic:       true,
+				PublicScope:    rbacutils.ScopeProject,
+				SharedProjects: []string{"p2"},
+			},
+			want: SShareInfo{
+				IsPublic:       true,
+				PublicScope:    rbacutils.ScopeProject,
+				SharedProjects: []string{"p2"},
+			},
+		},
+		{
+			name: "case4",
+			s1: SShareInfo{
+				IsPublic:      true,
+				PublicScope:   rbacutils.ScopeDomain,
+				SharedDomains: []string{"p1", "p2"},
+			},
+			s2: SShareInfo{
+				IsPublic:      true,
+				PublicScope:   rbacutils.ScopeDomain,
+				SharedDomains: []string{"p1", "p2"},
+			},
+			want: SShareInfo{
+				IsPublic:      true,
+				PublicScope:   rbacutils.ScopeDomain,
+				SharedDomains: []string{"p1", "p2"},
+			},
+		},
+		{
+			name: "case5",
+			s1: SShareInfo{
+				IsPublic:      true,
+				PublicScope:   rbacutils.ScopeDomain,
+				SharedDomains: []string{"p1", "p2", "p4"},
+			},
+			s2: SShareInfo{
+				IsPublic:      true,
+				PublicScope:   rbacutils.ScopeDomain,
+				SharedDomains: []string{"p1", "p2", "p3"},
+			},
+			want: SShareInfo{
+				IsPublic:      true,
+				PublicScope:   rbacutils.ScopeDomain,
+				SharedDomains: []string{"p1", "p2"},
+			},
+		},
+	}
+	for _, c := range cases {
+		inter := c.s1.Intersect(c.s2)
+		if !inter.Equals(c.want) {
+			t.Errorf("[%s] intersect got %#v != want %#v", c.name, inter, c.want)
+		}
+	}
+}

pkg/apis/zz_generated.model.go

@@ -24,6 +24,21 @@ type SAdminSharableVirtualResourceBase struct {
 	Records string `json:"records"`
 }
 
+// SCertificateResourceBase is an autogenerated struct via yunion.io/x/onecloud/pkg/cloudcommon/db.SCertificateResourceBase.
+type SCertificateResourceBase struct {
+	Certificate string `json:"certificate"`
+	PrivateKey  string `json:"private_key"`
+	// derived attributes
+	PublicKeyAlgorithm      string    `json:"public_key_algorithm"`
+	PublicKeyBitLen         int       `json:"public_key_bit_len"`
+	SignatureAlgorithm      string    `json:"signature_algorithm"`
+	Fingerprint             string    `json:"fingerprint"`
+	NotBefore               time.Time `json:"not_before"`
+	NotAfter                time.Time `json:"not_after"`
+	CommonName              string    `json:"common_name"`
+	SubjectAlternativeNames string    `json:"subject_alternative_names"`
+}
+
 // SDomainLevelResourceBase is an autogenerated struct via yunion.io/x/onecloud/pkg/cloudcommon/db.SDomainLevelResourceBase.
 type SDomainLevelResourceBase struct {
 	SStandaloneResourceBase

pkg/appsrv/workers.go

@@ -83,9 +83,6 @@ func (worker *SWorker) run() {
 			task := req.(*sWorkerTask)
 			if task.worker != nil {
 				task.worker <- worker
-				// worker channel is buffered
-				// close the worker channel
-				close(task.worker)
 			}
 			execCallback(task)
 		} else {

pkg/baremetal/handler/handlers.go

@@ -231,7 +231,7 @@ func handleServerStatus(ctx *Context, bm *baremetal.SBaremetalInstance, _ bareme
 
 func handleBaremetalRegister(ctx *Context, input *baremetal.BmRegisterInput) {
 	ctx.DelayProcess(func(data jsonutils.JSONObject) (jsonutils.JSONObject, error) {
-		baremetal.GetBaremetalManager().RegisterBaremetal(ctx, input)
+		baremetal.GetBaremetalManager().RegisterBaremetal(ctx, ctx.userCred, input)
 		return nil, nil
 	}, nil)
 }

pkg/baremetal/manager.go

@@ -289,7 +289,7 @@ func (i *BmRegisterInput) isTimeout() bool {
 }
 
 // delay task
-func (m *SBaremetalManager) RegisterBaremetal(ctx context.Context, input *BmRegisterInput) {
+func (m *SBaremetalManager) RegisterBaremetal(ctx context.Context, userCred mcclient.TokenCredential, input *BmRegisterInput) {
 	adminWire, err := m.checkNetworkFromIp(input.RemoteIp)
 	if input.isTimeout() {
 		return
@@ -341,7 +341,7 @@ func (m *SBaremetalManager) RegisterBaremetal(ctx context.Context, input *BmRegi
 	}
 
 	registerTask := tasks.NewBaremetalRegisterTask(
-		m, sshCli, input.Hostname, input.RemoteIp,
+		userCred, m, sshCli, input.Hostname, input.RemoteIp,
 		input.Username, input.Password, input.IpAddr,
 		ipmiMac, ipmiLanChannel, adminWire, ipmiWire,
 	)
@@ -377,6 +377,7 @@ func (m *SBaremetalManager) fetchIpmiIp(sshCli *ssh.Client) (string, error) {
 func (m *SBaremetalManager) checkNetworkFromIp(ip string) (string, error) {
 	params := jsonutils.NewDict()
 	params.Set("ip", jsonutils.NewString(ip))
+	params.Set("scope", jsonutils.NewString("system"))
 	params.Set("is_on_premise", jsonutils.JSONTrue)
 	res, err := modules.Networks.List(m.GetClientSession(), params)
 	if err != nil {
@@ -403,6 +404,7 @@ func (m *SBaremetalManager) verifyMacAddr(sshCli *ssh.Client) (error, bool) {
 	for _, nic := range nicinfo {
 		if len(nic.Mac) > 0 {
 			params.Set("any_mac", jsonutils.NewString(nic.Mac.String()))
+			params.Set("scope", jsonutils.NewString("system"))
 			res, err := modules.Hosts.List(m.GetClientSession(), params)
 			if err != nil {
 				return fmt.Errorf("Get hosts info failed: %s", err), false
@@ -750,11 +752,10 @@ func (b *SBaremetalInstance) SyncStatusBackground() {
 	}()
 }
 
-func (b *SBaremetalInstance) InitializeServer(name string) error {
+func (b *SBaremetalInstance) InitializeServer(s *mcclient.ClientSession, name string) error {
 	params := jsonutils.NewDict()
 	params.Set("name", jsonutils.NewString(name))
-	_, err := modules.Hosts.PerformAction(
-		b.manager.GetClientSession(), b.GetId(), "initialize", params)
+	_, err := modules.Hosts.PerformAction(s, b.GetId(), "initialize", params)
 	return err
 }
 
@@ -1039,6 +1040,7 @@ func (b *SBaremetalInstance) getSyslinuxPath(filename string, isTftp bool) strin
 func (b *SBaremetalInstance) findAccessNetwork(accessIp string) (*types.SNetworkConfig, error) {
 	params := jsonutils.NewDict()
 	params.Add(jsonutils.NewString(accessIp), "ip")
+	params.Add(jsonutils.NewString("system"), "scope")
 	params.Add(jsonutils.JSONTrue, "is_on_premise")
 	session := b.manager.GetClientSession()
 	ret, err := modules.Networks.List(session, params)
@@ -1949,6 +1951,8 @@ func (b *SBaremetalInstance) GetConsoleJNLP(ctx context.Context) (string, error)
 		return bmc.GetIloConsoleJNLP(ctx)
 	case "dell", "dell inc.":
 		return bmc.GetIdracConsoleJNLP(ctx, "", "")
+	case "supermicro":
+		return bmc.GetSupermicroConsoleJNLP(ctx)
 	}
 	return "", httperrors.NewNotImplementedError("Unsupported manufacture %s", manufacture)
 }

pkg/baremetal/options/options.go

@@ -55,3 +55,16 @@ type BaremetalOptions struct {
 var (
 	Options BaremetalOptions
 )
+
+func OnOptionsChange(oldO, newO interface{}) bool {
+	oldOpts := oldO.(*BaremetalOptions)
+	newOpts := newO.(*BaremetalOptions)
+
+	changed := false
+
+	if common_options.OnCommonOptionsChange(&oldOpts.CommonOptions, &newOpts.CommonOptions) {
+		changed = true
+	}
+
+	return changed
+}

pkg/baremetal/pxe/dhcp.go

@@ -272,6 +272,7 @@ func (req *dhcpRequest) findNetworkConf(session *mcclient.ClientSession, filterU
 		params.Add(jsonutils.JSONTrue, "filter_any")
 	}
 	params.Add(jsonutils.JSONTrue, "is_on_premise")
+	params.Add(jsonutils.NewString("system"), "scope")
 	ret, err := modules.Networks.List(session, params)
 	if err != nil {
 		return nil, err
@@ -299,6 +300,7 @@ func (req *dhcpRequest) findNetworkConf(session *mcclient.ClientSession, filterU
 func (req *dhcpRequest) findBaremetalsByUuid(session *mcclient.ClientSession) (*modulebase.ListResult, error) {
 	params := jsonutils.NewDict()
 	params.Add(jsonutils.NewString(req.ClientGuid), "uuid")
+	params.Add(jsonutils.NewString("system"), "scope")
 	ret, err := modules.Hosts.List(session, params)
 	if err != nil {
 		return nil, err
@@ -312,6 +314,7 @@ func (req *dhcpRequest) findBaremetalsByUuid(session *mcclient.ClientSession) (*
 func (req *dhcpRequest) findBaremetalsOfAnyMac(session *mcclient.ClientSession, isBaremetal bool) (*modulebase.ListResult, error) {
 	params := jsonutils.NewDict()
 	params.Add(jsonutils.NewString(req.ClientMac.String()), "any_mac")
+	params.Add(jsonutils.NewString("system"), "scope")
 	if isBaremetal {
 		params.Add(jsonutils.JSONTrue, "is_baremetal")
 	} else {

pkg/baremetal/service/service.go

@@ -21,6 +21,7 @@ import (
 
 	"yunion.io/x/log"
 
+	api "yunion.io/x/onecloud/pkg/apis/baremetal"
 	"yunion.io/x/onecloud/pkg/appsrv"
 	"yunion.io/x/onecloud/pkg/baremetal"
 	"yunion.io/x/onecloud/pkg/baremetal/handler"
@@ -28,6 +29,7 @@ import (
 	"yunion.io/x/onecloud/pkg/baremetal/tasks"
 	app_common "yunion.io/x/onecloud/pkg/cloudcommon/app"
 	"yunion.io/x/onecloud/pkg/cloudcommon/cronman"
+	"yunion.io/x/onecloud/pkg/cloudcommon/db/lockman"
 	common_options "yunion.io/x/onecloud/pkg/cloudcommon/options"
 	"yunion.io/x/onecloud/pkg/cloudcommon/service"
 	"yunion.io/x/onecloud/pkg/hostman/guestfs/fsdriver"
@@ -64,6 +66,9 @@ func (s *BaremetalService) StartService() {
 
 	fsdriver.Init(nil)
 	app := app_common.InitApp(&o.Options.BaseOptions, false)
+
+	common_options.StartOptionManager(&o.Options, o.Options.ConfigSyncPeriodSeconds, api.SERVICE_TYPE, api.SERVICE_VERSION, o.OnOptionsChange)
+
 	handler.InitHandlers(app)
 
 	s.startAgent(app)
@@ -80,6 +85,10 @@ func (s *BaremetalService) StartService() {
 }
 
 func (s *BaremetalService) startAgent(app *appsrv.Application) {
+	// init lockman
+	lm := lockman.NewInMemoryLockManager()
+	lockman.Init(lm)
+
 	err := baremetal.Start(app)
 	if err != nil {
 		log.Fatalf("Start agent error: %v", err)

pkg/baremetal/tasks/base.go

@@ -306,7 +306,13 @@ func (self *SBaremetalTaskBase) EnsurePowerUp() error {
 	if err != nil {
 		return errors.Wrapf(err, "Get power status")
 	}
+	maxTries := 10
+	count := 0
 	for status == "" || status == types.POWER_STATUS_OFF {
+		if count > maxTries {
+			break
+		}
+		log.Infof("Try power on %d times, pxe boot %v", count+1, self.PxeBoot)
 		if status == types.POWER_STATUS_OFF {
 			if self.PxeBoot {
 				err = self.Baremetal.DoPXEBoot()
@@ -314,7 +320,7 @@ func (self *SBaremetalTaskBase) EnsurePowerUp() error {
 				err = self.Baremetal.DoRedfishPowerOn()
 			}
 			if err != nil {
-				return errors.Wrapf(err, "Do boot power on")
+				log.Warningf("Do boot power on error: %v", err)
 			}
 		}
 		status, err = self.Baremetal.GetPowerStatus()
@@ -328,6 +334,7 @@ func (self *SBaremetalTaskBase) EnsurePowerUp() error {
 				return err
 			}
 		}
+		count++
 	}
 	if status != types.POWER_STATUS_ON {
 		return fmt.Errorf("Baremetal invalid restart status: %s", status)

pkg/baremetal/tasks/baseprepare.go

@@ -559,6 +559,7 @@ type ipmiIPConfig struct {
 func (task *sBaremetalPrepareTask) getIPMIIPConfig(ipAddr string) (*ipmiIPConfig, error) {
 	params := jsonutils.NewDict()
 	params.Add(jsonutils.NewString(ipAddr), "ip")
+	params.Add(jsonutils.NewString("system"), "scope")
 	params.Add(jsonutils.JSONTrue, "is_on_premise")
 	listRet, err := modules.Networks.List(task.getClientSession(), params)
 	if err != nil {

pkg/baremetal/tasks/bm_register.go

@@ -27,6 +27,8 @@ import (
 	o "yunion.io/x/onecloud/pkg/baremetal/options"
 	"yunion.io/x/onecloud/pkg/baremetal/utils/ipmitool"
 	"yunion.io/x/onecloud/pkg/cloudcommon/types"
+	"yunion.io/x/onecloud/pkg/mcclient"
+	"yunion.io/x/onecloud/pkg/mcclient/auth"
 	"yunion.io/x/onecloud/pkg/mcclient/modules"
 	"yunion.io/x/onecloud/pkg/util/redfish"
 	"yunion.io/x/onecloud/pkg/util/ssh"
@@ -55,24 +57,30 @@ type sBaremetalRegisterTask struct {
 	accessNic *types.SNicDevInfo
 }
 
-func NewBaremetalRegisterTask(bmManager IBmManager, sshCli *ssh.Client,
+func NewBaremetalRegisterTask(
+	userCred mcclient.TokenCredential, bmManager IBmManager, sshCli *ssh.Client,
 	hostname, remoteIp, ipmiUsername, ipmiPassword, ipmiIpAddr string,
 	ipmiMac net.HardwareAddr, ipmiLanChannel int, adminWire, ipmiWire string) *sBaremetalRegisterTask {
 	return &sBaremetalRegisterTask{
-		BmManager:      bmManager,
-		SshCli:         sshCli,
-		Hostname:       hostname,
-		RemoteIp:       remoteIp,
-		IpmiUsername:   ipmiUsername,
-		IpmiPassword:   ipmiPassword,
-		IpmiIpAddr:     ipmiIpAddr,
-		IpmiMac:        ipmiMac,
-		IpmiLanChannel: ipmiLanChannel,
-		AdminWire:      adminWire,
-		IpmiWire:       ipmiWire,
+		sBaremetalPrepareTask: sBaremetalPrepareTask{userCred: userCred},
+		BmManager:             bmManager,
+		SshCli:                sshCli,
+		Hostname:              hostname,
+		RemoteIp:              remoteIp,
+		IpmiUsername:          ipmiUsername,
+		IpmiPassword:          ipmiPassword,
+		IpmiIpAddr:            ipmiIpAddr,
+		IpmiMac:               ipmiMac,
+		IpmiLanChannel:        ipmiLanChannel,
+		AdminWire:             adminWire,
+		IpmiWire:              ipmiWire,
 	}
 }
 
+func (s *sBaremetalRegisterTask) getSession() *mcclient.ClientSession {
+	return auth.GetSession(context.Background(), s.userCred, o.Options.Region, "v2")
+}
+
 func (s *sBaremetalRegisterTask) getAccessDevMacAddr(ip string) (string, error) {
 	nicsRet, err := s.SshCli.Run("/sbin/ip -o -4 addr show")
 	if err != nil {
@@ -131,12 +139,12 @@ func (s *sBaremetalRegisterTask) CreateBaremetal() (string, error) {
 	}
 
 	params := jsonutils.NewDict()
-	params.Set("name", jsonutils.NewString("BM"+strings.Replace(s.accessNic.Mac.String(), ":", "", -1)))
+	params.Set("name", jsonutils.NewString(strings.Replace(s.accessNic.Mac.String(), ":", "", -1)))
 	params.Set("access_mac", jsonutils.NewString(s.accessNic.Mac.String()))
 	params.Set("host_type", jsonutils.NewString("baremetal"))
 	params.Set("is_baremetal", jsonutils.JSONTrue)
 	params.Set("is_import", jsonutils.JSONTrue)
-	res, err := modules.Hosts.CreateInContext(s.BmManager.GetClientSession(), params, &modules.Zones, zoneId)
+	res, err := modules.Hosts.CreateInContext(s.getSession(), params, &modules.Zones, zoneId)
 	if err != nil {
 		return "", fmt.Errorf("Create baremetal failed: %s", err)
 	}
@@ -177,6 +185,7 @@ func (s *sBaremetalRegisterTask) UpdateBaremetal() (string, error) {
 
 	params := jsonutils.NewDict()
 	params.Set("any_mac", jsonutils.NewString(accessMacAddr.String()))
+	params.Set("scope", jsonutils.NewString("system"))
 	res, err := modules.Hosts.List(s.BmManager.GetClientSession(), params)
 	if err != nil {
 		return "", fmt.Errorf("Fetch baremetal failed %s", err)
@@ -295,7 +304,7 @@ func (s *sBaremetalRegisterTask) updateBmInfo(cli *ssh.Client, i *baremetalPrepa
 }
 
 func (s *sBaremetalRegisterTask) initBaremetalServer() error {
-	if err := s.baremetal.InitializeServer(s.Hostname); err != nil {
+	if err := s.baremetal.InitializeServer(s.getSession(), s.Hostname); err != nil {
 		return fmt.Errorf("Baremteal Create Server Failed %s", err)
 	}
 	// if err := s.baremetal.SaveSSHConfig("", ""); err != nil {

pkg/baremetal/tasks/interface.go

@@ -64,7 +64,7 @@ type IBaremetal interface {
 	GetImageCacheUrl() string
 
 	RemoveServer()
-	InitializeServer(name string) error
+	InitializeServer(session *mcclient.ClientSession, name string) error
 	SaveSSHConfig(remoteAddr string, key string) error
 	ServerLoadDesc() error
 }

pkg/baremetal/tasks/ipmiprobe.go

@@ -70,29 +70,38 @@ func (self *SBaremetalIpmiProbeTask) DoIpmiProbe(ctx context.Context, args inter
 	}
 	redfishCli := redfish.NewRedfishDriver(ctx, "https://"+ipmiInfo.IpAddr, ipmiInfo.Username, ipmiInfo.Password, false)
 	if redfishCli != nil {
-		return self.doRedfishIpmiProbe(ctx, redfishCli)
-	} else {
-		log.Warningf("BMC not redfish-compatible")
-		ipmiTool := ipmitool.NewLanPlusIPMI(ipmiInfo.IpAddr, ipmiInfo.Username, ipmiInfo.Password)
-		return self.doRawIpmiProbe(ctx, ipmiTool)
+		redfishSuccess, err := self.doRedfishIpmiProbe(ctx, redfishCli)
+		if err == nil {
+			// success
+			return nil
+		}
+		if redfishSuccess {
+			return errors.Wrap(err, "doRedfishIpmiProbe")
+		}
+		// else, redfish call fails, try IPMI
 	}
+	log.Warningf("BMC not redfish-compatible")
+	ipmiTool := ipmitool.NewLanPlusIPMI(ipmiInfo.IpAddr, ipmiInfo.Username, ipmiInfo.Password)
+	return self.doRawIpmiProbe(ctx, ipmiTool)
 }
 
-func (self *SBaremetalIpmiProbeTask) doRedfishIpmiProbe(ctx context.Context, drv redfish.IRedfishDriver) error {
+// return redfishSuccess, error
+// redfishSuccess: does Redfish API call success
+func (self *SBaremetalIpmiProbeTask) doRedfishIpmiProbe(ctx context.Context, drv redfish.IRedfishDriver) (bool, error) {
 	confs, err := drv.GetLanConfigs(ctx)
 	if err != nil {
-		return errors.Wrap(err, "drv.GetLanConfigs")
+		return false, errors.Wrap(err, "drv.GetLanConfigs")
 	}
 	if len(confs) == 0 {
-		return errors.Wrap(httperrors.ErrNotFound, "no IPMI lan")
+		return false, errors.Wrap(httperrors.ErrNotFound, "no IPMI lan")
 	}
 	err = self.sendIpmiNicInfo(&confs[0])
 	if err != nil {
-		return errors.Wrap(err, "self.sendIpmiNicInfo")
+		return false, errors.Wrap(err, "self.sendIpmiNicInfo")
 	}
 	_, sysInfo, err := drv.GetSystemInfo(ctx)
 	if err != nil {
-		return errors.Wrap(err, "drv.GetSystemInfo")
+		return false, errors.Wrap(err, "drv.GetSystemInfo")
 	}
 	updateInfo := make(map[string]interface{})
 	if len(sysInfo.EthernetNICs) > 0 {
@@ -127,20 +136,20 @@ func (self *SBaremetalIpmiProbeTask) doRedfishIpmiProbe(ctx context.Context, drv
 	_, err = modules.Hosts.Update(self.Baremetal.GetClientSession(), self.Baremetal.GetId(), updateData)
 	if err != nil {
 		log.Errorf("Update baremetal info error: %v", err)
-		return errors.Wrap(err, "modules.Hosts.Update")
+		return true, errors.Wrap(err, "modules.Hosts.Update")
 	}
 	for i := range sysInfo.EthernetNICs {
 		mac, err := net.ParseMAC(sysInfo.EthernetNICs[i])
 		if err == nil {
 			err = self.sendNicInfo(i, mac)
 			if err != nil {
-				return errors.Wrapf(err, "sendNicInfo %d %s", i, mac)
+				return true, errors.Wrapf(err, "sendNicInfo %d %s", i, mac)
 			}
 		}
 	}
 	self.Baremetal.SyncStatus("", "Probe Redfish finished")
 	SetTaskComplete(self, nil)
-	return nil
+	return true, nil
 }
 
 func (self *SBaremetalIpmiProbeTask) sendIpmiNicInfo(lanConf *types.SIPMILanConfig) error {

pkg/cloudcommon/agent/agent.go

@@ -202,6 +202,7 @@ func (agent *SBaseAgent) getZoneByIP(session *mcclient.ClientSession) (jsonutils
 	}
 	params.Add(jsonutils.NewString(listenIP.String()), "ip")
 	params.Add(jsonutils.JSONTrue, "is_on_premise")
+	params.Add(jsonutils.NewString("system"), "scope")
 	networks, err := modules.Networks.List(session, params)
 	if err != nil {
 		return nil, err

pkg/cloudcommon/app/auth.go

@@ -19,13 +19,17 @@ import (
 	"time"
 
 	"yunion.io/x/log"
+	"yunion.io/x/pkg/errors"
 	"yunion.io/x/pkg/utils"
 
+	"yunion.io/x/onecloud/pkg/apis/identity"
 	"yunion.io/x/onecloud/pkg/cloudcommon/consts"
 	"yunion.io/x/onecloud/pkg/cloudcommon/notifyclient"
 	common_options "yunion.io/x/onecloud/pkg/cloudcommon/options"
 	"yunion.io/x/onecloud/pkg/cloudcommon/policy"
+	"yunion.io/x/onecloud/pkg/httperrors"
 	"yunion.io/x/onecloud/pkg/mcclient/auth"
+	"yunion.io/x/onecloud/pkg/mcclient/modules"
 )
 
 func InitAuth(options *common_options.CommonOptions, authComplete auth.AuthCompletedCallback) {
@@ -90,3 +94,19 @@ func InitBaseAuth(options *common_options.BaseOptions) {
 	}
 	consts.SetNonDefaultDomainProjects(options.NonDefaultDomainProjects)
 }
+
+func FetchEtcdServiceInfo() (*identity.EndpointDetails, error) {
+	s := auth.GetAdminSession(context.Background(), "", "")
+	ret, err := modules.EndpointsV3.GetByName(s, identity.ENDPOINT_ETCD_INTERNAL, nil)
+	if err != nil && errors.Cause(err) == httperrors.ErrNotFound {
+		return nil, nil
+	} else if err != nil {
+		return nil, err
+	}
+	endpoint := new(identity.EndpointDetails)
+	err = ret.Unmarshal(endpoint)
+	if err != nil {
+		return nil, errors.Wrap(err, "unmarshal endpoint")
+	}
+	return endpoint, nil
+}

pkg/cloudcommon/cronman/cronman.go

@@ -304,25 +304,7 @@ func (self *SCronJobManager) Start2(ctx context.Context, electObj *elect.Elect)
 		self.start(ctx)
 		return
 	}
-
-	go func() {
-		ch := make(chan elect.ElectEvent)
-		electObj.Subscribe(ch)
-		for {
-			select {
-			case ev := <-ch:
-				log.Infof("cronman: elect event %s: cronman", ev)
-				switch ev {
-				case elect.ElectEventWin:
-					self.start(ctx)
-				case elect.ElectEventLost:
-					self.Stop()
-				}
-			case <-ctx.Done():
-				return
-			}
-		}
-	}()
+	electObj.SubscribeWithAction(ctx, func() { self.start(ctx) }, self.Stop)
 }
 
 func (self *SCronJobManager) Start() {

pkg/cloudcommon/database.go

@@ -44,7 +44,7 @@ func InitDB(options *common_options.DBOptions) {
 
 	dialect, sqlStr, err := options.GetDBConnection()
 	if err != nil {
-		log.Fatalf("Invalid SqlConnection string: %s", options.SqlConnection)
+		log.Fatalf("Invalid SqlConnection string: %s error: %v", options.SqlConnection, err)
 	}
 	dbConn, err := sql.Open(dialect, sqlStr)
 	if err != nil {

pkg/cloudcommon/db/caller.go

@@ -292,7 +292,7 @@ func FetchCustomizeColumns(
 	retVal := make([]*jsonutils.JSONDict, ret[0].Len())
 	for i := 0; i < ret[0].Len(); i += 1 {
 		jsonDict := ValueToJSONDict(ret[0].Index(i))
-		jsonDict.Update(jsonutils.Marshal(objs[i]))
+		jsonDict.Update(jsonutils.Marshal(objs[i]).(*jsonutils.JSONDict))
 		retVal[i] = jsonDict
 	}
 	return retVal, nil

pkg/cloudcommon/db/certificateresource.go

@@ -0,0 +1,20 @@
+package db
+
+import (
+	"time"
+)
+
+type SCertificateResourceBase struct {
+	Certificate string `create:"required" list:"user" update:"user"`
+	PrivateKey  string `create:"required" list:"admin" update:"user"`
+
+	// derived attributes
+	PublicKeyAlgorithm      string    `create:"optional" list:"user" update:"user"`
+	PublicKeyBitLen         int       `create:"optional" list:"user" update:"user"`
+	SignatureAlgorithm      string    `create:"optional" list:"user" update:"user"`
+	Fingerprint             string    `create:"optional" list:"user" update:"user"`
+	NotBefore               time.Time `create:"optional" list:"user" update:"user"`
+	NotAfter                time.Time `create:"optional" list:"user" update:"user"`
+	CommonName              string    `create:"optional" list:"user" update:"user"`
+	SubjectAlternativeNames string    `create:"optional" list:"user" update:"user"`
+}

pkg/cloudcommon/db/db_dispatcher.go

@@ -352,7 +352,7 @@ func Query2List(manager IModelManager, ctx context.Context, userCred mcclient.To
 		showDetails = true
 	}
 	items := make([]interface{}, 0)
-	extraResults := make([]jsonutils.JSONObject, 0)
+	extraResults := make([]*jsonutils.JSONDict, 0)
 	rows, err := q.Rows()
 	if err != nil && err != sql.ErrNoRows {
 		return nil, err
@@ -371,17 +371,22 @@ func Query2List(manager IModelManager, ctx context.Context, userCred mcclient.To
 			return nil, err
 		}
 
-		if exportKeys != nil {
-			extraData := jsonutils.NewDict()
-			RowMap, err := q.Row2Map(rows)
+		if len(exportKeys) > 0 {
+			rowMap, err := q.Row2Map(rows)
 			if err != nil {
 				return nil, err
 			}
-			extraKeys := manager.GetExportExtraKeys(ctx, exportKeys, RowMap)
+			extraData := jsonutils.NewDict()
+			for k, v := range rowMap {
+				if len(v) > 0 {
+					extraData.Add(jsonutils.NewString(v), k)
+				}
+			}
+			extraKeys := manager.GetExportExtraKeys(ctx, exportKeys, rowMap)
 			if extraKeys != nil {
 				extraData.Update(extraKeys)
 			}
-			err = q.RowMap2Struct(RowMap, item)
+			err = q.RowMap2Struct(rowMap, item)
 			if err != nil {
 				return nil, err
 			}
@@ -399,26 +404,14 @@ func Query2List(manager IModelManager, ctx context.Context, userCred mcclient.To
 			}
 		}
 
-		// jsonDict := jsonutils.Marshal(item).(*jsonutils.JSONDict)
-		// jsonDict = jsonDict.CopyIncludes([]string(listF)...)
-		// jsonDict.Update(extraData)
-		// ignore GetExtraDetails since release/3.2
-		/*if showDetails && !query.Contains("export_keys") {
-			extraDict, _ := GetExtraDetails(item, ctx, userCred, query, true)
-			if extraDict != nil {
-				// Fix for Now
-				extraDict.Update(jsonDict)
-				jsonDict = extraDict
-			}
-			// jsonDict = getModelExtraDetails(item, ctx, jsonDict)
-		}*/
-		// results = append(results, jsonDict)
 		items = append(items, item)
 	}
 	results := make([]jsonutils.JSONObject, len(items))
-	if showDetails && !query.Contains("export_keys") {
+	if showDetails || len(exportKeys) > 0 {
 		var sortedListFields stringutils2.SSortedStrings
-		if len(fieldFilter) > 0 {
+		if len(exportKeys) > 0 {
+			sortedListFields = exportKeys
+		} else if len(fieldFilter) > 0 {
 			sortedListFields = stringutils2.NewSortedStrings(fieldFilter)
 		}
 		extraRows, err := FetchCustomizeColumns(manager, ctx, userCred, query, items, sortedListFields, true)
@@ -426,9 +419,21 @@ func Query2List(manager IModelManager, ctx context.Context, userCred mcclient.To
 		if err != nil {
 			return nil, errors.Wrap(err, "FetchCustomizeColumns")
 		}
+
 		if len(extraRows) == len(results) {
 			for i := range results {
-				results[i] = extraRows[i].CopyExcludes(listExcludes...)
+				jsonDict := extraRows[i].CopyExcludes(listExcludes...)
+				if i < len(extraResults) {
+					extraResults[i].Update(jsonDict)
+					jsonDict = extraResults[i]
+				}
+				if len(exportKeys) > 0 {
+					jsonDict = jsonDict.CopyIncludes(exportKeys...)
+				}
+				if len(fieldFilter) > 0 {
+					jsonDict = jsonDict.CopyIncludes(fieldFilter...)
+				}
+				results[i] = jsonDict
 			}
 		} else {
 			return nil, httperrors.NewInternalServerError("FetchCustomizeColumns return incorrect number of results")
@@ -436,8 +441,8 @@ func Query2List(manager IModelManager, ctx context.Context, userCred mcclient.To
 	} else {
 		for i := range items {
 			jsonDict := jsonutils.Marshal(items[i]).(*jsonutils.JSONDict).CopyExcludes(listExcludes...)
-			if i < len(extraResults) {
-				jsonDict.Update(extraResults[i])
+			if len(fieldFilter) > 0 {
+				jsonDict = jsonDict.CopyIncludes(fieldFilter...)
 			}
 			results[i] = jsonDict
 		}
@@ -648,7 +653,9 @@ func ListItems(manager IModelManager, ctx context.Context, userCred mcclient.Tok
 	}
 
 	if pagingConf != nil {
-		q = q.Limit(int(limit) + 1)
+		if limit > 0 {
+			q = q.Limit(int(limit) + 1)
+		}
 		if len(pagingMarker) > 0 {
 			markers := decodePagingMarker(pagingMarker)
 			for markerIdx, marker := range markers {
@@ -666,7 +673,7 @@ func ListItems(manager IModelManager, ctx context.Context, userCred mcclient.Tok
 			return nil, httperrors.NewGeneralError(err)
 		}
 		nextMarkers := make([]string, 0)
-		if int64(len(retList)) > limit {
+		if limit > 0 && int64(len(retList)) > limit {
 			for _, markerField := range pagingConf.MarkerFields {
 				nextMarker, _ := retList[limit].GetString(markerField)
 				nextMarkers = append(nextMarkers, nextMarker)
@@ -734,8 +741,10 @@ func calculateListResult(data []jsonutils.JSONObject, total, limit, offset int64
 			}
 		}
 		// do limit
-		if limit > 0 && total > limit {
+		if limit > 0 && total-offset > limit {
 			data = data[:limit]
+		} else {
+			data = data[:total-offset]
 		}
 	}
 
@@ -1215,6 +1224,12 @@ func (dispatcher *DBModelDispatcher) Create(ctx context.Context, query jsonutils
 	model, err := DoCreate(dispatcher.modelManager, ctx, userCred, query, data, ownerId)
 	if err != nil {
 		// log.Errorf("fail to doCreateItem %s", err)
+		if CancelPendingUsagesInContext != nil {
+			err := CancelPendingUsagesInContext(ctx, userCred)
+			if err != nil {
+				log.Errorf("CancelPendingUsagesInContext fail %s", err)
+			}
+		}
 		failErr := manager.OnCreateFailed(ctx, userCred, ownerId, query, data)
 		if failErr != nil {
 			log.Errorf("manager.OnCreateFailed %s", failErr)
@@ -1407,6 +1422,19 @@ func managerPerformCheckCreateData(
 		return nil, httperrors.NewForbiddenError("not allow to perform %s", action)
 	}
 
+	if InitPendingUsagesInContext != nil {
+		ctx = InitPendingUsagesInContext(ctx)
+
+		defer func() {
+			if CancelPendingUsagesInContext != nil {
+				err := CancelPendingUsagesInContext(ctx, userCred)
+				if err != nil {
+					log.Errorf("CancelPendingUsagesInContext fail %s", err)
+				}
+			}
+		}()
+	}
+
 	return ValidateCreateData(manager, ctx, userCred, ownerId, query, bodyDict)
 }
 

pkg/cloudcommon/db/domain.go

@@ -16,8 +16,10 @@ package db
 
 import (
 	"context"
+	"database/sql"
 
 	"yunion.io/x/jsonutils"
+	"yunion.io/x/pkg/errors"
 	"yunion.io/x/pkg/util/reflectutils"
 	"yunion.io/x/sqlchemy"
 
@@ -163,3 +165,25 @@ func (manager *SDomainizedResourceBaseManager) FetchCustomizeColumns(
 	}
 	return ret
 }
+
+func ValidateDomainizedResourceInput(ctx context.Context, input apis.DomainizedResourceInput) (*STenant, apis.DomainizedResourceInput, error) {
+	domain, err := DefaultDomainFetcher(ctx, input.ProjectDomain)
+	if err != nil {
+		if errors.Cause(err) == sql.ErrNoRows {
+			return nil, input, httperrors.NewResourceNotFoundError2("domain", input.ProjectDomain)
+		} else {
+			return nil, input, errors.Wrap(err, "TenantCacheManager.FetchDomainByIdOrName")
+		}
+	}
+	input.ProjectDomain = domain.GetId()
+	return domain, input, nil
+}
+
+func (manager *SDomainizedResourceBaseManager) ListItemExportKeys(ctx context.Context, q *sqlchemy.SQuery, userCred mcclient.TokenCredential, keys stringutils2.SSortedStrings) (*sqlchemy.SQuery, error) {
+	if keys.Contains("project_domain") {
+		domainsQ := DefaultDomainQuery().SubQuery()
+		q = q.LeftJoin(domainsQ, sqlchemy.Equals(q.Field("domain_id"), domainsQ.Field("id")))
+		q = q.AppendField(domainsQ.Field("name", "project_domain"))
+	}
+	return q, nil
+}